Create CBAM report: Importer obligations 2026 step by step

The transition phase of the EU Carbon Border Adjustment Mechanism (CBAM, Regulation (EU) 2023/956 of May 10, 2023) has been in effect since October 1, 2023, and importers of certain CO2-intensive goods are obliged to submit a quarterly CBAM report via the CBAM transition register. Six groups of goods are covered: cement, iron and steel, aluminum, fertilizers, electricity and hydrogen. The definitive phase starts on January 1, 2026, from then on importers must purchase CBAM certificates and bear the financial burden of the embedded emissions. The reporting obligation does not end there, but is replaced by an annual CBAM declaration.

This article explains step by step how importers create the CBAM report, which emission-related data must be collected, how the supplier connection works and how the reports can be documented in an audit-proof manner. CIVAC operates a compliance platform and Officer-as-a-Service: Licence the workspace for your internal officers, or have our officers order it. The reporting line to the management and to the responsible national CBAM authority (in Germany: DEHSt) is documented in a uniform file.

Every importer of goods that fall under the CN codes in Annex I to Regulation (EU) 2023/956 is required to report under CBAM if the goods are imported into the customs territory of the Union from a third country. According to Article 5 No. 15 of the Regulation, the importer is the approved applicant or the indirect customs representative who submits the customs declaration for release into free circulation.

The six groups of goods are specified in detail in Annex I according to CN codes: cement (heading 2507, 2517, 2523), iron and steel (heading 72, 73 with exceptions), aluminum (heading 76 with exceptions), Fertilizers (heading 2808, 2814, 2834, 3102, 3105), electricity (heading 2716) and hydrogen (heading 2804 10 00). Downstream products made from these materials also fall under the regulation.

The de minimis limit according to Article 2 Paragraph 3 stipulates that shipments with a value of less than 150 euros are not subject to reporting. For the majority of industrial imports, this limit is irrelevant because even a single ton of steel or aluminum exceeds the value. Anyone who imports small imports as a sample for private customers checks the border individually.

Indirect customs representatives, who actually carry out the importer's duties, also assume the CBAM reporting obligation, provided they are authorised to represent them. Anyone who uses a freight forwarder or a customs agency should clarify the CBAM distribution of duties in writing. In practice, a mixed form is common in which the customs agency submits the declaration and the importer provides the emission-related data.

The shipments subject to CBAM are identified operationally via the ERP system using the CN codes and the supplier countries. Data quality will be the key bottleneck in 2026 because many companies do not consistently manage their CN codes or do not systematically file supplier origins.

CIVAC documents the CBAM reporting requirement via the function of the Supply Chain Officer, who manages the interface between customs, purchasing and compliance. Audit-proof, documented, Art. 2-firm.

The CBAM quarterly report must contain a series of predefined data points detailed in the EU Commission's implementing regulations (Implementing Regulation (EU) 2023/1773 of August 17, 2023). The data structure is standardised and is transmitted electronically via the CBAM transition register. Manual reporting is not planned.

Mandatory data is, firstly, the identification of the importer (EORI number, name, address). Secondly, the identification of imported goods by CN code, quantity in metric tonnes, country of origin and facility of origin. Thirdly, the specific direct emissions per tonne in tCO2eq, separated by production route.

Fourthly, the specific indirect emissions per tonne in tCO2eq, where relevant according to Annex IV of the regulation. Fifthly, the CO2 price already paid in the third country (Carbon Price Paid), which enables later crediting in the definitive phase. Sixth, the calculation and measurement method (standard values, direct measurement, calculation based on activity data).

During the transition phase until the end of 2025, standard values ​​published by the EU Commission are permitted. However, these standard values ​​are chosen conservatively and lead to higher certificate costs in the definitive phase. From January 1, 2026, standard values ​​are only permitted under strict conditions; as a rule, the actual emissions must be documented by the third-country supplier.

The data structure follows the XML schema of the CBAM transition register and is published by the DEHSt. Anyone who generates reports from an ERP system should integrate the XML schema into the mapping process. Entering the data manually is possible, but no longer economical for around 100 shipments per quarter.

CIVAC provides an audit template for the CBAM data structure and supplier communication. The 490 ready-to-use audit templates include the supplier cover letter, the data request and the plausibility report. More details in the CIVAC FAQ.

The biggest operational hurdle in the CBAM report is obtaining emissions-related data from third-country suppliers. In 2026, this data will not be available in a standardised manner in many supply chains because plant emissions are not mandatorily documented in every third country. Importers must actively request the data and check its plausibility.

The EU Commission provides a template for collecting data from suppliers (CBAM Communication Template). This template records the plant identification, the production quantity, the direct and indirect emissions, the production route and the CO2 price already paid. Suppliers typically complete the template on an asset basis, not a shipment basis.

In practice, three bottlenecks arise. Firstly, the language hurdle, because the template is in English and local language versions are required in many third countries. Secondly, the methodological hurdle, because the EU calculation method is not recognised in every third country and suppliers often use their own methods. Thirdly, there is the commercial hurdle, because suppliers perceive the data request as an additional burden and do not always deliver in a timely manner.

Those who manage the supplier onboarding process in a structured manner gain significantly in data quality. Standardized cover letters, clear deadlines and escalating reminders are operationally effective. Anyone who embeds the data request in a contractual framework (e.g. supplementary contractual clauses to the CBAM data obligation) increases the liability even further.

The plausibility check of the supplier data is the second routine. Anyone who receives data from the supplier questionnaire compares it with the EU Commission's standard values ​​and with industry benchmarks. Conspicuous deviations are explained in the report or replaced by a follow-up survey.

CIVAC bundles supplier letters, plausibility workflows and escalation paths in the workspace. Anyone who conducts supplier communication in one source of truth avoids duplication of work between purchasing, customs and compliance. The auditor calls, the evidence is ready.

The deadline for submitting the CBAM quarterly report is one month after the end of the quarter. For the first quarter, the report must be submitted by April 30th, for the second by July 31st, for the third by October 31st, and for the fourth by January 31st of the following year. These deadlines are regulated in Article 35 of Regulation (EU) 2023/956.

Delayed reports or missing reports are sanctioned in accordance with Article 16 of Implementing Regulation (EU) 2023/1773. The fine ranges from 10 to 50 euros per ton of unreported or incompletely reported embedded emissions. In practice, fines for medium-sized importers with high steel or aluminum imports can quickly reach six-figure amounts.

Corrections to previous reports are possible within two months of the report being submitted, and thereafter only after approval by the national CBAM authority. Anyone who recognises errors should make the correction on their own initiative because, according to its own information from 2025, the DEHSt sanctions subsequent corrections less strictly than undetected errors.

The DEHSt in Germany is the responsible national authority according to Article 11 of the regulation. It checks the reports submitted on a random basis and also carries out regular, event-related checks. Conspicuous deviations between reported emissions and industry benchmarks typically trigger an inquiry.

Anyone who receives a fine can lodge an objection in accordance with the general rules of Section 67 OWiG. The probability of success in the objection process depends on the documentation. Anyone who can provide complete documentation of the report data has significantly better chances than the importer who has to subsequently reconstruct their data sources.

CIVAC maintains the CBAM report submissions with the date, responsible persons and documents in the workspace. Audit-proof, documented, Art. 35-firm. Deadline runs from the end of the quarter, not from internal escalation.

According to Article 7 of Regulation (EU) 2023/956, embedded emissions are the direct and indirect greenhouse gas emissions that arise during the production of the goods. Annex IV of the Regulation defines the specific production routes and the associated calculation methods for each group of goods. The methodology is based on the EU Emissions Trading System (EU ETS).

Direct emissions are the emissions from the production processes of the plant itself, i.e. typically from the combustion of fossil fuels and from process-related reactions. Indirect emissions are the emissions from purchased electricity used for production. Indirect emissions are particularly relevant for aluminum and fertilizers.

The specific emissions per ton are calculated by dividing the annual plant emissions by the annual production quantity. Suppliers typically have to derive the data from their own emissions balance, which requires additional modelling work in third countries without a comparable emissions trading system.

Standard values ​​are permitted during the transition phase according to Article 4 (3) of the Implementing Regulation if no actual data is available. The EU Commission has published the standard values ​​in the respective sector guidelines. They are typically above the real plant emissions in order to create incentives for actual data collection.

From August 1, 2024, in the transition phase, reports must be submitted exclusively on the basis of actual emissions, if available. Default values ​​are only allowed in narrow exceptional cases. From the definitive phase (January 1, 2026), the emissions for the certificate calculation must be verified by an independent accredited auditor.

The verification requires accreditation in accordance with Annex VI of the regulation. Accredited examiners are listed with the German Accreditation Council (DAkkS). The test itself is based on the ISO 14064-3 standard and comparable standards. Anyone who does not reserve capacity early risks delays in the annual CBAM declaration.

The definitive phase of the CBAM begins on January 1, 2026. Importers must purchase a CBAM certificate for each tonne of embedded emissions, the price of which is based on the weekly average price of the EU ETS auctions. The certificates are sold through the CBAM registry operated by the relevant national authorities.

Importers must register as approved CBAM declarants in the Definitive Phase before placing the first CBAM product on the market. Approval is granted by the national CBAM authority upon application. In Germany the DEHSt is responsible. The application process includes identity verification, security and proof of financial ability.

The annual CBAM declaration must be submitted by May 31 of the following year. It includes the CBAM goods imported in the previous year with verified emissions, the calculated certificate requirements and the third country CO2 prices already paid. The difference is compensated for by issuing CBAM certificates.

The security deposit at the end of the quarter is 80 percent of the expected certificate requirement for the goods imported in the quarter. Anyone who does not deposit the security on time risks having their approval as a CBAM applicant suspended and thus a de facto import ban for the goods concerned.

The transition from the reporting requirement to the certificate requirement significantly shifts the economic weight of CBAM compliance. Where data quality was previously the focus, from 2026 onwards the financial advance planning of certificate costs will become a strategic task. Importers with high volumes of steel or aluminum from third countries will integrate the certificate costs into the procurement strategy.

CIVAC supports transition planning via the interface to the supply chain officer and the ESG officer. The reporting line to the management is consolidated. More about interlocking in the Roller Catalog.

The operational creation of the CBAM report typically comes from a data pipeline that connects the ERP system, customs declaration and supplier database. The data pipeline must bring together four sources: the master data (CN codes, suppliers, systems), the movement data (shipments, quantities, values), the emissions data (supplier information, standard values) and the CO2 price data (third country payments).

The shipments are extracted from the ERP system every quarter and filtered by CN code. The shipments subject to CBAM are then linked to the suppliers’ system data. This step requires clean master data maintenance: Each supplier must clearly reference the specific production plant because the emissions data is plant-related.

The emissions data comes either directly from the supplier (CBAM Communication Template) or from a standard values ​​library. The data pipeline must evaluate both sources and document the applicable method. The report specifies the method (actual data or default value).

Submission to the CBAM transition register is done via the XML schema or via the web mask. SAP, Oracle, Microsoft Dynamics and several industry ERPs will offer standardised CBAM modules or interfaces to specialised compliance tools in 2026. Those who don't yet have an integration typically start with an Excel pipeline and migrate after the first few quarters.

Data quality control is the central weak point in most pipelines. Anyone who does not carry out a systematic check of the CN codes, the units of quantity and the emission values ​​risks inconsistencies that will be noticed in the DEHSt's sample check. The audit logs belong in the CBAM file.

CIVAC documents the data pipeline, the audit logs and the delivery confirmations in an audit-proof manner in the workspace. Licence the workspace for your internal representatives, or have our representatives order it. The interface to the ERP is managed via structured data recording or API connection, depending on the client size.

CBAM is not isolated, but is operationally interlinked with the Supply Chain Due Diligence Act (LkSG, in force since January 1, 2023, from January 1, 2024 also for companies with 1,000 employees or more), with the CSRD (Directive (EU) 2022/2464) and with general supplier management. Anyone who carries out these obligations in parallel gains significant synergies.

The LkSG risk analysis according to Section 5 LkSG records human rights and environmental risks in the supply chain. CO2-intensive production in third countries is also regularly a climate-related risk according to Section 2 (3) LkSG. Anyone who carries out an LkSG risk analysis has already set up a large part of the CBAM supplier connection.

The CSRD and the associated ESRS require detailed disclosure on greenhouse gas emissions in Scope 3 (upstream value chain) from the respective years of application. The CBAM emissions data can be integrated into Scope 3 reporting because it is structured for each supplier and plant.

General supplier management uses the CBAM data for strategic procurement planning. Suppliers with low emission intensities will become more economically attractive from 2026 because the CBAM certificate costs are incorporated directly into the unit costs. The procurement strategy is shifting in favor of low-emission supply chains.

If you manage these three areas separately, you risk duplication of work and inconsistent data. Anyone who bundles them into one platform gains efficiency and data quality. CIVAC bundles LkSG, CSRD preparation and CBAM in one workspace so that supplier letters, risk analysis and reports flow from a single source of truth.

Operational integration is achieved by appointing combined officer roles: supply chain officer, ESG officer and compliance officer work in the same workspace, with the same audit templates and the same reporting line. Others run compliance like a filing cabinet. We run it like software. More about the interlocking in the CIVAC contribution to EU regulation 2026.

The CBAM report only has an operational effect when it is managed as a recurring quarterly routine and not as a one-off event. CIVAC operates a compliance platform and Officer-as-a-Service: Each quarterly submission is presented in an auditable file with data extraction, plausibility check, supplier escalation, report submission and board notification.

The model is two-stage. Licence the workspace for your internal representatives, or have our representatives order it. Both paths lead to the same file: appointment certificate, signed, filed, verifiable. 490 ready-to-use audit templates, 93 controls according to ISO/IEC 27001:2022 and a dedicated CBAM workflow are productive from day 1. EU data residency is guaranteed throughout.

The order duration is 2 working days instead of the classic 2 to 6 weeks on the market. Importers with high volumes of steel, aluminum or fertilizer from third countries use CIVAC to keep the CBAM quarterly submissions with the LkSG routine and CSRD preparation in a uniform file.

If you want to make the transition from the Excel pipeline to an auditable workspace, write to info@civac.de or use the contact form on civac.de. Turn reading into an assignment. The initial discussions typically last 30 minutes and end with a concrete indication for the appointment of the supply chain representative and the connection to the CBAM pipeline.

Onboarding takes 2 working days and ends with a signed appointment certificate, a documented reporting line to management and an active workspace in which the CBAM data structure, supplier communication and quarterly report templates are neatly filed from day 1.

Once you work like this, you rarely turn back back to the Excel stack. The quarterly submissions will become a predictable routine, and the definitive phase from 2026 will become a calculable task. The auditor calls, the evidence is ready. The management receives monthly reports from the same workspace in which the supervisory authority also finds the complete file status in random cases.