EU CBAM Penalties 2026–2027
The Definitive Compliance Intelligence Report on Financial Penalties, Enforcement Risk, Certificate Shortfalls, and Practical Strategies to Avoid Non-Compliance
Disclaimer: Published by CBAM Journal (Sekason Research Limited, London) for informational purposes only and not as legal, financial, or professional advice. For full terms, visit: https://www.cbamjournal.com/disclaimer
1. Executive Summary
The Shift from Reporting to Financial Liability
FINDING: The EU CBAM definitive regime entered into force on 1 January 2026, converting the transitional reporting obligation into a legally enforceable financial compliance framework requiring Authorised CBAM Declarant status, certificate purchases, and an annual declaration with certificate surrender by 30 September 2027.
SO WHAT: Every EU importer of CBAM-covered goods is now subject to direct financial exposure: failure to surrender sufficient certificates by 30 September 2027 triggers a statutory penalty of €100 per tonne of CO₂e not covered, under Article 26(1) of Regulation (EU) 2023/956.
NOW WHAT: Compliance teams must treat 2026 as the first full operational compliance year — not a continuation of the transitional period — and ensure authorised declarant status, emissions verification systems, and certificate planning are operational before 30 September 2027.
Article 26 Carries a Double Financial Obligation That Most Risk Assessments Miss
FINDING: Article 26(1) of Regulation (EU) 2023/956 links the financial penalty for certificate shortfall to the EU ETS excess emissions penalty of € 100 per tonne of CO₂e, and Article 26(1) explicitly confirms that payment of the penalty does not remove the obligation to surrender the missing CBAM certificates.
SO, WHAT: An importer who surrenders too few certificates faces two simultaneous financial obligations: the € 100/tCO₂e statutory penalty and the continuing cost of purchasing and surrendering the missing certificates — making non-compliance more expensive than compliance, not a substitute for it.
NOW WHAT: Compliance teams must model their maximum certificate shortfall exposure and establish quarterly certificate reconciliation processes to eliminate the risk of double financial exposure by 30 September 2027.
The double-jeopardy structure of Article 26 is the most consequential financial feature of the EU CBAM penalty regime. The €100/tCO₂e penalty accrues on any missing certificate, and the certificate obligation remains outstanding regardless of whether the penalty has been paid. An importer with a 1,000 tCO₂e shortfall faces €100,000 in statutory penalties (illustrative: 1,000 × €100) plus the cost of acquiring and surrendering 1,000 additional certificates at the prevailing market price. Both obligations run concurrently.
Germany’s national enforcement authority, the Emissions Trading Authority (DEHSt), has confirmed in its published CBAM guidance that repeated infringements may ultimately lead to revocation of Authorised CBAM Declarant status — removing the right to import CBAM-covered goods entirely.
Published Regulation Specifies Obligations but Not the Operational Systems Required to Meet Them
FINDING: The European Commission has published legislation and sector-specific guidance covering what importers must do under the definitive CBAM regime, but published guidance does not prescribe how organisations should build governance structures, internal control frameworks, certificate planning systems, or board reporting processes to manage penalty risk.
SO, WHAT: Compliance teams that rely on regulatory guidance alone possess legal knowledge but lack operational frameworks — a structural gap between understanding the obligation and building the systems required to meet it consistently.
NOW WHAT: This report provides the CBAM Penalty Prevention Framework, the Internal Controls Checklist, the CBAM Annual Compliance Calendar, the 90-Day Readiness Plan, and illustrative financial exposure scenarios — all designed to be implemented before 30 September 2027.
Sections 5 through 7 contain the highest operational density and are designed to be used as working documents. The Penalty Scenario Models in Section 5, the CBAM Governance Framework in Section 3, and the 90-Day Readiness Plan in Section 7 can be extracted and presented directly to executive leadership.
2. Regulatory Context
Article 26 Sits Within a Four-Level Legislative Architecture That Determines Total Penalty Exposure
FINDING: The primary legal basis for EU CBAM financial penalties is Article 26 of Regulation (EU) 2023/956, which links the certificate shortfall penalty to Article 16(3) of Directive 2003/87/EC (the EU ETS Directive), establishing a penalty rate of €100 per tonne of CO₂e not covered by surrendered certificates.
SO, WHAT: The penalty is not a standalone CBAM sanction — it is embedded within a compliance architecture spanning Regulation (EU) 2023/956, implementing regulations on verification and certificate pricing, and the EU ETS Directive — meaning compliance failures at any point in the chain generate Article 26 exposure.
NOW WHAT: Compliance teams must map each legal instrument to a specific internal ownership responsibility before 30 September 2027, ensuring customs, finance, procurement, and compliance functions each understand their obligations under the relevant regulation.
The legislative hierarchy governing EU CBAM penalties operates at four levels. At the apex sits Regulation (EU) 2023/956, which establishes the Authorised CBAM Declarant requirement under Article 4, the annual declaration obligation under Article 6, the certificate surrender requirement under Articles 22–23, and the financial penalty regime under Article 26. Beneath this, implementing regulations prescribe operational detail: Commission Implementing Regulation (EU) 2025/2546 governs verification of declared embedded emissions; Commission Implementing Regulation (EU) 2025/2547 establishes the methods for calculating embedded emissions; and Commission Implementing Regulation (EU) 2025/2548 governs the calculation and publication of CBAM certificate prices. The EU ETS Directive (2003/87/EC) provides the penalty reference through Article 16(3), which establishes the €100/tCO₂e excess emissions penalty that Article 26(1) adopts by reference.
The financial integration between CBAM and the EU ETS has a further consequence: any future policy change to the EU ETS excess emissions penalty rate will directly affect CBAM penalty exposure. Article 26(1) does not fix the penalty independently — it adopts the prevailing EU ETS rate. Compliance Managers should monitor both CBAM legislation and EU ETS reform simultaneously.
Table 1: Regulatory Instruments Matrix — EU CBAM Penalty Framework
Instrument | Key Articles | Operational Obligation | Penalty Link |
Regulation (EU) 2023/956 | Article 4 | Authorised CBAM Declarant status required for all imports of in-scope goods | Art. 26(2): national penalty for importing without status |
Regulation (EU) 2023/956 | Article 6 | Annual CBAM declaration: verified emissions, carbon price paid, certificates to surrender | Enforcement action for inaccurate or missing declarations |
Regulation (EU) 2023/956 | Articles 22–23 | Certificate surrender corresponding to verified embedded emissions, due 30 September annually | Art. 26(1): €100/tCO₂e for shortfall |
Regulation (EU) 2023/956 | Article 26(1) | Financial penalty for insufficient certificate surrender; penalty does not discharge surrender obligation | Links to EU ETS excess emissions penalty: €100/tCO₂e |
Regulation (EU) 2023/956 | Article 26(2) | Penalty for importing without Authorised Declarant status | Member State-determined; must be effective, proportionate, dissuasive |
Implementing Reg. (EU) 2025/2546 | Verification principles | Embedded emissions must be independently verified before declaration submission | Unverified emissions invalidate declaration, triggering Art. 26(1) risk |
Implementing Reg. (EU) 2025/2547 | Calculation methods | Approved methodology mandatory for all embedded emissions calculations | Wrong methodology → incorrect certificate count → Art. 26(1) exposure |
Implementing Reg. (EU) 2025/2548 | Certificate pricing | Quarterly average EU ETS price used for CBAM certificate valuation | Determines the market cost of any certificate shortfall |
EU ETS Directive 2003/87/EC | Article 16(3) | Reference rate for excess emissions penalty | Provides the €100/tCO₂e rate adopted by Art. 26(1) |
Implementing Reg. (EU) 2025/486 | Authorisation rules | Process for obtaining and maintaining Authorised CBAM Declarant status | Loss of status possible for repeated serious infringement |
The Definitive Regime Created Direct Financial Liability Where Only Administrative Reporting Existed Before
FINDING: During the EU CBAM transitional period from 1 October 2023 to 31 December 2025, importers were required only to submit quarterly embedded emissions reports under Commission Implementing Regulation (EU) 2023/1773; from 1 January 2026, the definitive regime requires Authorised CBAM Declarant status, mandatory certificate purchases, annual declarations, and certificate surrender — all backed by Article 26 financial penalties.
SO, WHAT: Importers who treat 2026 as an extension of the transitional period are exposed to Article 26 penalties that did not apply to transitional non-compliance — a category error with direct financial consequences.
NOW WHAT: Compliance Managers must update all internal compliance manuals, supplier engagement processes, and governance frameworks to reflect financial obligations — not reporting-only requirements — before the 30 September 2027 first declaration deadline.
Table 2: Transitional Regime vs Definitive Regime — Compliance Comparison
Dimension | Transitional Period (Oct 2023 – Dec 2025) | Definitive Regime (from 1 Jan 2026) |
Primary obligation | Quarterly embedded emissions reports under Reg. (EU) 2023/1773 | Annual declaration + certificate surrender by 30 September annually |
Certificate purchase | Not required | Mandatory; certificates available for purchase from 1 February 2027 |
Financial penalties | Administrative sanctions for reporting failures under transitional rules | Article 26: €100/tCO₂e for certificate shortfall |
Authorised Declarant status | Declarant status requirements differed from the definitive regime | Mandatory for all imports of CBAM goods from 1 January 2026 |
Verification requirement | Quarterly estimates accepted in some cases | Verified embedded emissions required for annual declaration |
Penalty persistence | Penalty satisfied the underlying obligation | Penalty does NOT remove the certificate surrender obligation |
Declaration frequency | Quarterly reports | Annual declaration (30 September deadline each year) |
CBAM Certificate Pricing Floats with the EU ETS, Exposing Compliance Costs to Market Volatility
FINDING: CBAM certificate prices are calculated as a quarterly average of EU ETS allowance auction prices under Implementing Regulation (EU) 2025/2548, with EU ETS allowance prices in 2025 fluctuating between approximately €60 and €80 per tonne of CO₂e per European Commission data, making CBAM compliance costs directly sensitive to EU ETS price movements.
SO, WHAT: An importer with verified embedded emissions of 10,000 tCO₂e across 2026 imports (illustrative) faces a certificate obligation valued between €600,000 and €800,000 depending on the EU ETS price at the time of certificate purchase — and a penalty exposure of €1,000,000 if the full surrender obligation is missed.
NOW WHAT: Finance teams must integrate quarterly EU ETS price monitoring into budgeting and treasury planning and build a sensitivity buffer covering at least ±20% of EU ETS price volatility into CBAM compliance cost projections, with the first certificate purchase window opening on 1 February 2027.
The pricing link between CBAM and the EU ETS creates a compliance planning challenge distinct from most regulatory obligations: the financial cost of compliance is not fixed at the time the obligation arises. An importer importing in January 2026 cannot know with certainty how much their CBAM certificates will cost when purchased from 1 February 2027, because certificate prices are calculated as the quarterly average of EU ETS auction prices in the preceding quarter. The financial integration also means that any future policy change to the EU ETS excess emissions penalty rate will directly affect CBAM penalty exposure.
The Council’s June 2026 Strengthening Position Signals Tighter Enforcement and Expanding Scope
FINDING: On 12 June 2026, the Council of the European Union agreed its negotiating position on amendments to strengthen Regulation (EU) 2023/956, including measures to simplify compliance for smaller importers, reinforce anti-circumvention rules, improve implementation, and prepare CBAM for future scope expansion.
SO, WHAT: Reinforcement of anti-circumvention provisions and preparation for future scope expansion signals that the compliance burden is likely to increase as the regime matures — organisations that build scalable compliance systems now will face lower adaptation costs when legislative amendments are enacted.
NOW WHAT: Compliance Managers must establish a quarterly regulatory monitoring process covering both Commission guidance updates and Council legislative developments to ensure internal frameworks remain current throughout 2026 and 2027.
Table 3: Key Regulatory Developments Timeline 2025–2026
Date | Development | Regulatory Significance |
17 Dec 2025 | European Commission publishes simplification and strengthening package (Proposal to Simplify and Strengthen CBAM, Omnibus I) | Introduces Implementing Regs (EU) 2025/2546, 2025/2547, 2025/2548; updates verification and certificate pricing rules |
1 Jan 2026 | Definitive CBAM regime enters into force | Financial obligations, Authorised Declarant status, and certificate surrender become legally enforceable under Article 26 |
7 Apr 2026 | First official CBAM certificate prices published by European Commission | Enables compliance budgeting and certificate valuation for the definitive regime for the first time |
12 Jun 2026 | Council of the EU agrees position on strengthening CBAM | Anti-circumvention measures and future scope expansion confirmed as legislative objectives |
13 Jul 2026 | HMRC publishes CBAM Force of Law Notice and Reference Document (UK) | UK CBAM preparation advances; detailed UK penalty regime equivalent to Article 26 remains outstanding |
3. Compliance Obligations
Authorised CBAM Declarant Status Is a Precondition for Legal Import, Not an Administrative Formality
FINDING: Under Article 4 of Regulation (EU) 2023/956, imports of CBAM goods into the EU may only be made by an Authorised CBAM Declarant from 1 January 2026, and importers were advised to submit authorisation applications by 31 March 2026 to ensure uninterrupted import operations under the definitive regime.
SO, WHAT: Importing CBAM-covered goods without authorised declarant status exposes the importer to Article 26(2) penalties — determined by Member States and required to be effective, proportionate, and dissuasive, with gravity, duration, intentionality, repetition, and cooperation with authorities all factoring into the national penalty assessment.
NOW WHAT: Any importer that has not yet submitted an authorisation application through the CBAM Authorisation Management Module must do so immediately, as every shipment of CBAM goods made without authorised status after 1 January 2026 represents a continuing breach accumulating Article 26(2) exposure.
The authorised declarant requirement is the foundational compliance obligation of the definitive CBAM regime. Without valid Authorised CBAM Declarant status, an importer cannot legally import CBAM-covered goods. The European Commission’s updated 2026 guidance specifically urges importers and indirect customs representatives to submit applications through the CBAM Authorisation Management Module as early as possible. Germany’s DEHSt has confirmed that repeated infringements can ultimately lead to revocation of Authorised CBAM Declarant status — removing the right to import CBAM goods entirely. The scope of Article 26(2) exposure increases with duration: the longer unauthorised importing continues, the greater the gravity and duration factors that Member State authorities must weigh.
Certificate Planning Must Begin in 2026 to Avoid a Shortfall When the Purchase Window Opens in February 2027
FINDING: Under Articles 22–23 of Regulation (EU) 2023/956, authorised declarants must surrender the number of CBAM certificates corresponding to their verified embedded emissions for the preceding calendar year by 30 September annually, with the first surrender due on 30 September 2027 covering all 2026 imports; certificate purchases open on 1 February 2027.
SO, WHAT: The gap between the close of the 2026 compliance year (31 December 2026) and the opening of certificate sales (1 February 2027) is not administrative slack — it is the window in which verification must be completed so that accurate certificate planning can be executed before the 30 September 2027 deadline.
NOW WHAT: Certificate planning must begin during 2026: importers must track embedded emissions quarterly throughout the year so that the 1 February 2027 purchase window can be used efficiently and the 30 September 2027 surrender deadline is met without a shortfall.
The certificate lifecycle has four stages: calculation, purchase, holding, and surrender. At the calculation stage, the risk is incorrect embedded emissions data — generating either an under-surrender (triggering Article 26(1)) or an over-purchase (a financial loss). At the purchase stage, the risk is price volatility: certificates are priced at the quarterly average EU ETS auction price, meaning importers face market risk between when they calculate exposure and when they buy. At the holding stage, the risk is inadequate monitoring of the certificate inventory against import volumes. At the surrender stage, the risk is a deadline miss.
The treatment of excess certificates not surrendered by 30 September should be confirmed with the competent authority: importers should seek guidance from their national competent authority on the precise regulatory mechanics before the February 2027 purchase window opens.
Declaration Accuracy Determines Both Legal Compliance and Certificate Adequacy
FINDING: Article 6 of Regulation (EU) 2023/956 requires every Authorised CBAM Declarant to submit an annual CBAM declaration containing the quantity of imported goods, verified embedded emissions, any carbon price paid outside the EU, and the number of CBAM certificates to be surrendered, with the first declaration deadline of 30 September 2027 covering the full 2026 calendar year.
SO, WHAT: An inaccurate annual declaration — from incorrect embedded emissions, unverified supplier figures, or errors in the carbon price paid adjustment — creates Article 26(1) certificate shortfall risk if surrendered certificates do not match actual verified emissions, in addition to triggering direct enforcement action by the competent authority.
NOW WHAT: Compliance Managers must build a declaration preparation process with an internal completion deadline at least 60 days before 30 September 2027 — recommended no later than 31 July 2027 — to allow adequate time for data validation, verification, management approval, and error correction before the statutory deadline.
The annual CBAM declaration must contain four specific components: the quantity of each category of imported CBAM goods; the total embedded emissions for those goods; the carbon price already paid in a third country (which may reduce the certificate obligation where a qualifying carbon pricing scheme exists); and the total number of CBAM certificates to be surrendered. Under Implementing Regulation (EU) 2025/2547, emissions must be calculated using the prescribed methodology; under Implementing Regulation (EU) 2025/2546, those calculations must be independently verified. An importer who submits a declaration based on unverified supplier data creates a declaration accuracy risk that the competent authority may identify during review or audit.
Documentation Gaps Undermine Compliance Position Before Any Inspection Begins
FINDING: Regulation (EU) 2023/956 and Implementing Regulation (EU) 2025/2546 require importers to maintain embedded emissions records, production process documentation, and verification evidence sufficient to support the annual declaration; Germany’s DEHSt has confirmed in its CBAM guidance that the ability to produce documentation promptly during an inspection strengthens the compliance position.
SO, WHAT: Weak or incomplete documentation does not just create an audit risk — it undermines the ability to challenge incorrect penalty assessments, contest competent authority decisions, or demonstrate good-faith compliance when factors such as cooperation with authorities are assessed under Article 26(2).
NOW WHAT: A centralised CBAM evidence repository must be established before 31 December 2026, with document retention periods aligned to the competent authority’s expected review cycle and ownership assigned to a named individual within the organisation.
Specific document types required span multiple business functions and supply chain partners. The European Commission does not currently prescribe a single standard retention period for CBAM compliance records. Where specific retention periods have not been published in official guidance, a minimum of five years is recommended, consistent with equivalent EU customs and ETS compliance documentation standards — pending further Commission guidance.
Fragmented Ownership Across Functions Is Itself a Source of Article 26 Exposure
FINDING: Regulation (EU) 2023/956 and its implementing regulations assign CBAM compliance responsibilities across customs, finance, procurement, and compliance management functions but prescribe no internal governance model for how these responsibilities should be coordinated within the importing organisation.
SO, WHAT: Where CBAM responsibility is fragmented across functions without a central coordination mechanism, errors in one function cascade into declaration inaccuracies, certificate shortfalls, and ultimately Article 26 penalty exposure.
NOW WHAT: Before 30 September 2027, every importing organisation must establish a named CBAM Compliance Owner with cross-functional authority across customs, finance, procurement, and sustainability teams, supported by a documented governance framework mapping obligations, owners, frequencies, and evidence outputs.
Table 4: CBAM Governance Framework™ — Obligations by Function
Function | Primary Obligation | Frequency | Key Output | Penalty Risk if Absent |
Board / Executive | Oversight of CBAM compliance programme and financial exposure | Quarterly | Board approval of compliance strategy and budget | Insufficient resource; missed deadlines |
CBAM Compliance Owner | Central coordination of all CBAM obligations; declaration submission | Ongoing; annual declaration | Annual declaration submission; compliance calendar | Declaration errors; certificate shortfalls |
Customs / Trade | Authorised Declarant status; import classification; declaration data | Per shipment; annual review | Authorisation maintenance; goods data for declaration | Art. 26(2) exposure; declaration inaccuracies |
Finance / Treasury | Certificate budgeting; purchase; surrender; penalty reserve | Quarterly (purchase); annual (surrender) | Certificate purchase confirmation; budget model | Certificate shortfall; unplanned cost exposure |
Procurement | Supplier emissions data collection; supplier due diligence | Per supplier; annual update | Verified emissions documentation from suppliers | Incorrect embedded emissions → wrong certificate count |
Internal Audit | Independent compliance review; inspection readiness assessment | Annually; pre-declaration | Audit findings; inspection readiness report | Undetected errors discovered by competent authority |
Legal / Compliance | Regulatory monitoring; contract terms; penalty risk assessment | Quarterly | Legal review of declaration; supplier contract updates | Undetected regulatory changes; inadequate supplier terms |
4. Key Dates and Deadlines
The 2026 Compliance Year Is Already Running: Three Years of Obligations Converge on 30 September 2027
FINDING: The EU CBAM definitive regime commenced on 1 January 2026, following a transitional reporting-only phase from 1 October 2023 to 31 December 2025, with the first statutory declaration and certificate surrender deadline fixed at 30 September 2027 for all imports made during the 2026 calendar year.
SO, WHAT: Compliance Managers who have not yet completed the authorisation, supplier engagement, and emissions data collection phases of the 2026 compliance cycle are now operating behind the statutory timeline — compressing verification and certificate planning into a shorter and higher-risk window.
NOW WHAT: Treat 2026 as the live financial compliance year: all embedded emissions from 2026 imports must be verified and ready for declaration by 30 September 2027, which means verification processes must be operational throughout 2026, not initiated in 2027.
Table 5: EU CBAM Definitive Regime — Full Compliance Timeline
Date | Milestone | Compliance Action Required |
1 Oct 2023 | Transitional CBAM begins | Quarterly embedded emissions reports required under Reg. (EU) 2023/1773. No certificate purchases required. |
31 Dec 2025 | Transitional period ends | Final quarterly report submitted. Compliance systems must be upgraded to definitive regime requirements. |
1 Jan 2026 | Definitive regime enters into force | Authorised CBAM Declarant status mandatory. Financial obligations begin. Article 26 penalties apply to all non-compliance from this date. |
31 Mar 2026 | Recommended authorisation deadline | Commission guidance advises applications submitted by this date to avoid import disruption. |
Throughout 2026 | 2026 compliance year | Collect verified embedded emissions data for all CBAM imports. Maintain records. Prepare certificate exposure model. |
7 Apr 2026 | First official certificate prices published | Use quarterly prices for compliance budgeting and financial exposure modelling. |
12 Jun 2026 | Council strengthening position agreed | Monitor legislative developments. Anti-circumvention and future scope expansion confirmed as objectives. |
1 Feb 2027 | Certificate purchase window opens | Commission central platform opens for certificates covering 2026 verified embedded emissions. |
30 Sep 2027 | FIRST ANNUAL DECLARATION AND CERTIFICATE SURRENDER DEADLINE | Submit annual declaration (Art. 6) and surrender required certificates (Arts. 22–23). Failure triggers Art. 26(1): €100/tCO₂e for every missing certificate. |
30 Sep (annually) | Ongoing annual compliance | Annual declaration and certificate surrender repeat for each prior calendar year’s imports. |
Missing 30 September 2027 Triggers Both a Financial Penalty and a Continuing Certificate Obligation
FINDING: The 30 September 2027 deadline for the first annual CBAM declaration and certificate surrender is a hard statutory date under Article 26(1) of Regulation (EU) 2023/956: missing this deadline exposes the importer to a financial penalty of €100 per tonne of CO₂e for every certificate not surrendered on time, with the obligation to surrender the missing certificates persisting after penalty payment.
SO, WHAT: A mid-sized EU importer with 5,000 tCO₂e of verified embedded emissions who surrenders no certificates by 30 September 2027 faces an immediate statutory penalty of €500,000 (illustrative: 5,000 × €100) plus the obligation to purchase and surrender 5,000 certificates at the prevailing market price — both obligations running simultaneously.
NOW WHAT: Set an internal declaration readiness deadline of no later than 31 July 2027 (recommended: 60 days before the statutory deadline) to allow adequate time for verification, management sign-off, and error correction before submission.
Table 6: Critical Compliance Deadlines — Financial Consequences
Deadline | Obligation | Owner | Consequence if missed |
31 Mar 2026 (recommended) | Submit Authorised CBAM Declarant application | Customs / Trade | Art. 26(2): Member State penalty for each shipment imported without status |
Throughout 2026 | Collect and verify embedded emissions for all 2026 imports | Procurement / ESG | Incorrect declaration → certificate shortfall → Art. 26(1) penalty at €100/tCO₂e |
1 Feb 2027 | Certificate purchase window opens | Finance / Treasury | No direct penalty; delay compresses time available before 30 Sep 2027 deadline |
31 Jul 2027 (recommended internal) | Internal declaration readiness review complete | CBAM Compliance Owner | No statutory penalty; but late internal deadline compresses error-correction window before 30 Sep |
30 Sep 2027 | Submit annual declaration + surrender certificates | Compliance Owner + Finance | Art. 26(1): €100/tCO₂e for every missing certificate; continuing obligation to surrender outstanding certificates |
30 Sep (annually) | Repeat annual declaration and certificate surrender | CBAM Compliance Owner | Art. 26(1) exposure applies every year at the same statutory rate |
A Month-by-Month Compliance Calendar Prevents the Year-End Compression That Creates Certificate Shortfalls
FINDING: The European Commission confirms the 30 September annual declaration and certificate surrender deadline but does not prescribe how organisations should structure their data collection, verification, and submission processes throughout the year.
SO, WHAT: Without a structured internal calendar, organisations compress all verification, certificate procurement, and management approval into the final weeks before the 30 September deadline — creating avoidable errors, insufficient time for correction, and disproportionate operational pressure on compliance teams.
NOW WHAT: Adopt the CBAM Annual Compliance Calendar below as the internal planning framework for the full 2026–2027 compliance cycle, assigning ownership for each milestone before end of Q3 2026 (recommended internal target).
Table 7: CBAM Annual Compliance Calendar — 2026–2027 Cycle
Month | Action | Owner | Output |
Jan 2026 | Confirm Authorised Declarant status; identify all in-scope imports; initiate supplier engagement | Customs + Procurement | Supplier engagement log; authorisation confirmation |
Feb–Mar 2026 | Distribute emissions data requests to all CBAM-covered suppliers | Procurement | Supplier data templates; response tracking log |
Apr 2026 | Review Q1 import data; use first published certificate prices for budgeting | Compliance Owner + Finance | Q1 embedded emissions estimate; updated compliance cost budget |
May–Jun 2026 | Validate supplier data; chase outstanding responses; assess verification status | Procurement + ESG | Updated supplier data log; verification engagement plan |
Jul 2026 | Mid-year review: H1 embedded emissions estimate; certificate exposure model | Compliance Owner + Finance | H1 exposure model; certificate budget update; board report |
Aug–Sep 2026 | Confirm verification arrangements with accredited verifier for 2026 data | ESG / Compliance Owner | Verifier appointment confirmed; verification scope agreed |
Oct–Nov 2026 | Collect and finalise H2 supplier emissions data | Procurement | Full-year embedded emissions data set |
Dec 2026 | Full-year emissions consolidation; internal audit; board budget approval | Compliance Owner + Internal Audit | Draft declaration data; audit findings; board approval |
Jan–Feb 2027 | Commence verification process; open certificate purchase window 1 Feb 2027 | ESG + Finance | Verification report in progress; certificates purchased |
Mar–May 2027 | Complete verification; review declaration draft; management sign-off | Compliance Owner + Legal | Verified emissions report; reviewed declaration draft |
Jun–Jul 2027 | Internal declaration readiness review; final certificate reconciliation | CBAM Compliance Owner | Declaration ready; certificate count confirmed |
31 Jul 2027 (recommended) | Internal submission readiness deadline | CBAM Compliance Owner | Declaration prepared and ready for statutory submission |
30 Sep 2027 | Submit annual declaration; surrender CBAM certificates | Compliance Owner + Finance | Declaration submitted; certificates surrendered; compliance confirmed |
5. Financial Exposure and Penalty Risk
Article 26 Generates Two Simultaneous Financial Obligations: The Penalty and the Outstanding Certificate Cost
FINDING: Article 26(1) of Regulation (EU) 2023/956 provides that where an Authorised CBAM Declarant fails to surrender the required number of CBAM certificates by 30 September, the competent authority must impose a financial penalty equivalent to the EU ETS excess emissions penalty under Article 16(3) of Directive 2003/87/EC — currently €100 per tonne of CO₂e — and explicitly confirms that payment of the penalty does not remove the obligation to surrender the missing certificates.
SO, WHAT: A certificate shortfall generates two simultaneous financial obligations: the €100/tCO₂e statutory penalty and the market cost of the missing certificates — making non-compliance materially more expensive than compliance in every scenario.
NOW WHAT: Compliance teams must model worst-case certificate shortfall exposure before 30 September 2027, treating any shortfall as generating both penalty and certificate obligations simultaneously rather than as an either/or trade-off.
The Article 26(1) penalty mechanism is binary and non-negotiable: where the number of certificates surrendered is less than the number corresponding to verified embedded emissions, the deficit is measured in tonnes of CO₂e and the competent authority must impose €100 per missing tonne. Payment does not discharge the surrender obligation. Germany’s DEHSt has confirmed in its published CBAM guidance that the penalty applies per missing certificate and that the underlying surrender obligation remains — consistent with Article 16(3) of the EU ETS Directive, which establishes the same double-obligation structure for excess EU ETS emissions.
EU ETS Price Volatility Creates a Floating Compliance Cost That Compounds Every Year
FINDING: EU ETS allowance prices in 2025 fluctuated between approximately €60 and €80 per tonne of CO₂e, per European Commission data, meaning that a CBAM certificate obligation of 10,000 tCO₂e (illustrative) carries a market cost between €600,000 and €800,000 at those price levels, plus a penalty exposure of €1,000,000 at €100/tCO₂e if the full surrender obligation is missed.
SO, WHAT: The combination of a floating certificate price and a fixed €100/tCO₂e penalty rate creates an asymmetric exposure: when EU ETS prices are below €100, the penalty exceeds the market cost of compliance — making non-compliance doubly irrational as well as doubly costly.
NOW WHAT: Finance teams must model compliance costs at minimum, central, and maximum EU ETS price scenarios and maintain a contingency reserve equivalent to at least one quarter’s worth of certificate purchase costs to absorb price volatility before the 1 February 2027 purchase window opens.
Financial exposure develops through three additive channels. First, the certificate market cost: certificates required multiplied by the quarterly average EU ETS certificate price at time of purchase. Second, the penalty exposure: missing certificates multiplied by €100/tCO₂e. Third, the residual certificate obligation: missing certificates that must still be purchased even after the penalty is paid. None substitutes for any other. An importer who underestimates embedded emissions during 2026 because supplier data is incomplete, unverified, or based on incorrect defaults faces compounding risk through every subsequent stage of the compliance cycle.
The Statutory Penalty Formula Is Precise and Applies Without Discretion
FINDING: The statutory penalty calculation formula under Article 26(1) of Regulation (EU) 2023/956 is: Penalty = shortfall in surrendered certificates (tCO₂e) × €100 per tCO₂e, with the EU ETS excess emissions penalty rate of €100/tCO₂e confirmed as the applicable rate under Article 16(3) of Directive 2003/87/EC.
SO, WHAT: Even modest certificate shortfalls generate disproportionate financial consequences when combined with the continuing surrender obligation: a 10% shortfall on a 10,000 tCO₂e programme generates a €100,000 penalty plus €70,000 in residual certificate costs (illustrative, using €70/tCO₂e certificate price within the confirmed 2025 EU ETS range).
NOW WHAT: Run at least three shortfall scenarios — 5%, 15%, and 30% certificate shortfall against expected embedded emissions — before the 2026 compliance year closes, to quantify the financial risk of imperfect supplier data and prioritise data validation resources accordingly.
Note: The illustrative scenarios below apply the statutory Article 26(1) penalty formula at €100/tCO₂e and use a certificate market cost of €70/tCO₂e (within the 2025 EU ETS price range of €60–€80 per tonne confirmed by the European Commission). These are analytical planning examples only. They are not official regulatory calculations, and actual certificate prices will reflect quarterly EU ETS averages at the time of purchase.
Table 8: Penalty Scenario Models — Illustrative Certificate Shortfall Analysis
Scenario | Certificates Required (tCO₂e) | Certificates Surrendered | Shortfall | Art. 26(1) Penalty (@€100) | Residual Certificate Cost (@€70) | Total Exposure |
A — Small importer, 5% shortfall | 2,000 | 1,900 | 100 | €10,000 | €7,000 | €17,000 |
B — Mid-size, 10% shortfall | 10,000 | 9,000 | 1,000 | €100,000 | €70,000 | €170,000 |
C — Mid-size, 30% shortfall | 10,000 | 7,000 | 3,000 | €300,000 | €210,000 | €510,000 |
D — Large importer, 5% shortfall | 50,000 | 47,500 | 2,500 | €250,000 | €175,000 | €425,000 |
E — Large importer, 15% shortfall | 50,000 | 42,500 | 7,500 | €750,000 | €525,000 | €1,275,000 |
F — Zero surrender | 10,000 | 0 | 10,000 | €1,000,000 | €700,000 | €1,700,000 |
Non-Financial Consequences of CBAM Non-Compliance Can Exceed the Statutory Fine
FINDING: Article 26(2) of Regulation (EU) 2023/956 requires Member States to impose penalties for importing without Authorised CBAM Declarant status, with amounts determined nationally based on gravity, duration, scope, intentional or negligent behaviour, repetition, and cooperation with authorities; Germany’s DEHSt has confirmed that repeated serious infringements may lead to revocation of Authorised CBAM Declarant status.
SO, WHAT: Loss of Authorised CBAM Declarant status removes the legal right to import CBAM-covered goods into the EU — a supply chain continuity risk of a different order from a financial penalty, affecting all six covered sectors simultaneously.
NOW WHAT: Compliance Managers must present CBAM penalty risk to executive leadership as a supply chain continuity issue, not merely a financial line item, and must ensure the enterprise risk management framework includes CBAM authorisation status as a critical operational dependency.
The Article 26(1) financial penalty is quantifiable and plannable. Non-financial consequences of sustained CBAM non-compliance are less predictable and potentially more damaging. The Council of the European Union’s June 2026 agreement to strengthen the CBAM regime specifically targets anti-circumvention — a signal that enforcement will move toward more sophisticated scrutiny of supply chain structures and emissions data accuracy in subsequent compliance cycles.
Table 9: Enterprise Risk Matrix — EU CBAM Non-Compliance
Risk Category | Risk Event | Trigger | Potential Consequence |
Financial | Certificate shortfall penalty | Insufficient surrender by 30 September | €100/tCO₂e × shortfall; plus, continuing obligation to purchase and surrender missing certificates |
Financial | Penalty for unauthorised imports | Importing without Authorised Declarant status | National penalty under Art. 26(2): effective, proportionate, dissuasive; calculated per infringement |
Operational | Revocation of Authorised Declarant status | Repeated serious infringement (confirmed by DEHSt) | Loss of legal right to import CBAM-covered goods into the EU |
Regulatory | Increased competent authority scrutiny | Declaration errors or certificate shortfall identified | Expanded inspection of prior periods; formal investigation |
Reputational | Public enforcement record | Competent authority publishes enforcement decision | Customer, investor, and partner confidence damage |
Legal | Inaccurate declaration | Incorrect embedded emissions or certificate count submitted | Enforcement action under Member State implementation of Regulation (EU) 2023/956 |
Supply Chain | Import disruption | Loss of or failure to obtain authorisation | Inability to import CBAM-covered goods; supply chain interruption across all covered sectors |
Certificate Purchases Are Only One Component of Total CBAM Compliance Cost
FINDING: The European Commission and implementing regulations prescribe the legal obligations for CBAM certificate purchase and surrender but do not prescribe how organisations should budget for total compliance cost — which includes certificate purchases, embedded emissions verification, compliance staff, external consultancy, internal audit, and legal review.
SO, WHAT: Organisations that budget only for certificate purchases under-resource the verification, governance, and audit infrastructure that prevents the data errors leading to Article 26(1) exposure — converting an apparent cost saving into a larger penalty risk.
NOW WHAT: Finance teams must build a CBAM compliance budget covering all cost components before 31 December 2026, with a sensitivity analysis showing the impact of EU ETS price movements of ±20% on total certificate cost, securing board approval of an adequate compliance reserve before the close of 2026.
Note: Certificate cost estimates below reference the 2025 EU ETS price range of €60–€80/tCO₂e per European Commission data as an illustrative reference only. Actual costs will reflect quarterly EU ETS averages at the time of purchase.
Table 10: CBAM Budgeting Model — Total Compliance Cost Components
Cost Component | Description | Frequency | Sensitivity Factor |
CBAM certificate purchases | Certificates × quarterly average EU ETS price at time of purchase | Annual (from 1 Feb 2027) | High — directly linked to EU ETS price volatility |
Third-party emissions verification | Accredited verifier costs for embedded emissions audit under Reg. (EU) 2025/2546 | Annual | Medium — varies by supplier count and production complexity |
Compliance staff resource | Internal time for declaration management, data collection, and governance | Ongoing | Low–Medium — scales with import volume and supplier count |
External consultancy / legal | Specialist CBAM regulatory advice; declaration review; supplier contract updates | Annual or as needed | Medium — higher in first two compliance years |
Supplier data collection | Cost of supplier engagement programme and emissions data systems | Annual | Medium — varies by number and geography of third-country suppliers |
Internal audit | Pre-declaration compliance review; inspection readiness assessment | Annual | Low — relatively fixed cost |
Penalty contingency reserve | Reserve for unforeseen shortfall or enforcement costs | Annual provision | High — sized against worst-case shortfall scenario using confirmed €100/tCO₂e rate |
EU ETS ±20% sensitivity buffer | Additional certificate budget if ETS price rises above central estimate | Annual provision | High — EU ETS prices fluctuated €60–€80 in 2025; further volatility should be assumed |
6. Sector-Specific Impact Analysis
Article 26(1) of Regulation (EU) 2023/956 applies uniformly across all six covered sectors: iron and steel, aluminium, cement, fertilisers, hydrogen, and electricity. Financial exposure differs between sectors because embedded emissions intensities and import volumes vary by product — not because different penalty rates apply. The European Commission has published sector-specific guidance for all six sectors. The analysis below identifies where sector characteristics create specific compliance risks.
Iron and Steel: Highest Volume, Highest Complexity, Highest Exposure
FINDING: Iron and steel represent the largest and most compliance-exposed CBAM sector, with the European Commission providing dedicated importer guidance, producer guidance, webinars, and e-learning that reflect the sector’s high embedded emissions, complex production routes (BF-BOF and EAF), and significant EU import volumes.
SO, WHAT: For EU importers of steel, compliance risk is compounded by production-route variation: blast furnace-basic oxygen furnace (BF-BOF) routes produce materially higher embedded emissions than electric arc furnace (EAF) routes, meaning importers without installation-specific verified emissions data face both declaration accuracy risk and systematic certificate shortfall across large import volumes.
NOW WHAT: Steel importers must prioritise installation-level emissions verification from all third-country producers, with verification completed before 31 January 2027 (recommended, to allow accurate certificate planning before the 1 February 2027 purchase window opens).
The European Commission does not publish a standard carbon intensity benchmark (to₂/tonne of steel) because embedded emissions depend on the specific installation, production technology, and fuel mix. India is among the major external suppliers of steel products to the EU. EU importers sourcing from Indian producers must engage those producers for verified embedded emissions data under the approved methodology; where Indian producers cannot provide verified data, there is a risk of default values being applied, creating compliance uncertainty.
Aluminium: Direct Emissions Only — Indirect Electricity Emissions Are Excluded from Scope
FINDING: Aluminium embedded emissions calculations under Regulation (EU) 2023/956 are limited to direct production process emissions; indirect emissions from electricity consumption used in aluminium production are excluded from the CBAM embedded emissions scope for this sector — verify the precise scope applicable to your supply with your accredited verifier and at Annex II of Regulation (EU) 2023/956.
SO, WHAT: Importers who have calculated aluminium embedded emissions inclusive of electricity-related indirect emissions must correct their methodology — an overstatement inflates certificate requirements and costs, while an understatement creates Article 26(1) exposure.
NOW WHAT: Aluminium importers must verify with their accredited verifier that embedded emissions calculations apply the correct direct-emissions scope before finalising 2026 annual declaration data, with verification completed before 31 January 2027 (recommended internal deadline, one month before the 1 February 2027 purchase window).
Primary aluminium from smelters with high-carbon electricity sources has materially different direct process emissions from secondary recycled aluminium. This variation requires installation-level data. No official per-tonne CBAM liability has been published by the Commission for aluminium, as liability depends on the specific installation, prevailing EU ETS certificate price, and any recognised foreign carbon pricing credit.
Cement: Process Emissions and Combustion Emissions Both Apply, Creating High Per-Tonne Exposure
FINDING: Cement production is one of the most carbon-intensive activities covered by CBAM, with embedded emissions arising from both fuel combustion and the process emissions from calcination of limestone — meaning that inaccurate clinker ratio or kiln technology data from producers will systematically distort the embedded emissions calculation and create certificate shortfall risk.
SO, WHAT: Because cement embedded emissions are typically high per tonne of product, even a modest percentage error in the calculation — from incorrect clinker ratios or unverified fuel mix data — can generate a material certificate shortfall and a disproportionate Article 26(1) penalty exposure.
NOW WHAT: Cement importers must obtain verified installation-level emissions data that separately identifies process emissions and combustion emissions for each producer before the close of the 2026 compliance year, with all data validated against Implementing Regulation (EU) 2025/2547 methodology.
The European Commission has published dedicated guidance for cement importers and non-EU cement producers, including sector-specific webinars and e-learning. Importers should confirm with their accredited verifier whether their supplier data is sufficient to avoid default value application, which may carry a mark-up above actual emissions under Commission implementing regulations. Verify the applicable default value rules at Implementing Regulation (EU) 2025/2621 and add this regulation to your sources if it applies to your supply chain.
Fertilisers: Product-Level Pathway Distinction Is Required, Not Sector-Level Averaging
FINDING: The fertiliser sector requires product-level embedded emissions data because emissions arise from multiple production pathways — ammonia production, hydrogen production, and energy-intensive manufacturing — with different products within the category (ammonia, urea, ammonium nitrate) carrying materially different embedded emissions profiles.
SO, WHAT: Importers who apply a single emissions factor across a fertiliser product range without distinguishing between production pathways and product types generate a structural declaration error that creates both Article 26(1) exposure risk and a potential competent authority review under Implementing Regulation (EU) 2025/2546.
NOW WHAT: Fertiliser importers must ensure supplier emissions documentation distinguishes between production pathways at the product level, with all data validated against Implementing Regulation (EU) 2025/2547 methodology before 31 December 2026 (recommended internal completion date, being the close of the 2026 compliance year).
Hydrogen: Production Pathway Verification Is the Primary Determinant of Certificate Exposure
FINDING: Hydrogen is a CBAM-covered sector under Regulation (EU) 2023/956 in which embedded emissions vary dramatically by production pathway: grey hydrogen (natural gas, no carbon capture) carries high emissions, blue hydrogen (natural gas with carbon capture) carries moderate emissions, and green hydrogen (renewable electrolysis) carries near-zero embedded emissions.
SO, WHAT: An EU importer of hydrogen who cannot verify the production pathway of their supply risks applying an incorrect emissions intensity, creating either a significant certificate over-purchase (wasted capital) or an Article 26(1) exposure where the actual pathway carries higher emissions than assumed.
NOW WHAT: Hydrogen importers must obtain production pathway verification from all third-country suppliers before the close of the 2026 compliance year, with pathway-specific verified emissions data confirmed under Implementing Regulation (EU) 2025/2547 before 31 December 2026 (recommended internal completion date, being the close of the 2026 compliance year).
International hydrogen supply chains are at an earlier stage of development than those for steel or cement, and documentation infrastructure for production pathway verification may be less mature at some third-country producers. Where suppliers cannot provide verified pathway data under the approved methodology, the risk of default value application is correspondingly higher.
Electricity: Grid-Mix Methodology Creates Calculation Complexity Not Present in Other Sectors
FINDING: Electricity imports under Regulation (EU) 2023/956 follow sector-specific methodologies distinct from other CBAM sectors, because embedded emissions depend primarily on the generation technology and grid mix of the exporting country rather than on a single production installation, requiring importers to apply Commission-prescribed calculation methodologies that account for national grid characteristics.
SO, WHAT: The same volume of imported electricity can carry materially different CBAM certificate obligations depending on the exporting country’s generation structure — an importer sourcing from a coal-heavy grid faces fundamentally different financial exposure from one sourcing from a renewables-dominant grid.
NOW WHAT: Electricity importers must confirm the applicable calculation methodology with both their third-country counterparty and the national competent authority before the 2026 compliance year data is finalised, ensuring grid-specific emission factors are sourced from Commission-approved sources under Implementing Regulation (EU) 2025/2547.
Table 11: Sector Comparison Matrix — EU CBAM Compliance Characteristics
Sector | Emissions Type | Key Compliance Complexity | Penalty Exposure Level | Official Guidance Available |
Iron & Steel | Direct (BF-BOF or EAF route) | Production route variation; third-country supply chain data quality | Very High | Yes — importer and producer guidance published |
Aluminium | Direct only (indirect electricity excluded — verify scope at Annex II Reg. 2023/956) | Correct emissions scope must be applied; electricity emissions excluded | Very High | Yes |
Cement | Direct (combustion + process/calcination emissions) | Clinker ratio; process vs. combustion split; default value mark-up risk | High | Yes |
Fertilisers | Direct (production pathway-specific) | Product-level pathway distinction required: ammonia, urea, ammonium nitrate differ | High | Yes |
Hydrogen | Direct (pathway-dependent: grey/blue/green) | Production pathway verification; emerging supply chains with immature documentation | High | Yes |
Electricity | Grid-mix dependent (sector-specific methodology) | National grid mix; interconnector rules; generation technology factors | Moderate–High | Yes |
7. Practical Compliance Framework
The CBAM Penalty Prevention Framework™ Converts Legal Obligations into Eight Operational Stages
FINDING: Regulation (EU) 2023/956 and its implementing regulations specify what importers must do to comply with the EU CBAM, but do not prescribe how organisations should build the governance, workflow, and internal control infrastructure required to prevent compliance failures.
SO, WHAT: Organisations that understand the law but have not built the operational systems to execute compliance consistently face the exact gap that Article 26(1) closes: knowing what is required is not the same as having the systems in place to deliver it reliably across a multi-supplier, multi-product, multi-function compliance obligation.
NOW WHAT: Implement the CBAM Penalty Prevention Framework below — an end-to-end compliance lifecycle covering eight stages from supplier due diligence to board assurance — before the 2026 compliance year data is finalised on 31 December 2026.
Table 12: CBAM Penalty Prevention Framework
Stage | Key Actions | Owner | Output | Risk if Absent |
1. Supplier Due Diligence | Identify all CBAM-covered suppliers; assess data capability; update contracts to mandate verified emissions data | Procurement | Supplier register; updated contracts; data request templates | Missing or unverified emissions data → declaration errors → Art. 26(1) |
2. Emissions Verification | Appoint accredited verifier; verify installation-level embedded emissions under Regs. (EU) 2025/2546 and 2025/2547 | ESG / Compliance | Signed verification report | Unverified emissions → invalid declaration → Art. 26(1) exposure |
3. Import Controls | Confirm Authorised Declarant status; classify all imports; collect customs data for declaration | Customs / Trade | Authorisation confirmation; import classification log | Unauthorised imports → Art. 26(2) national penalty per shipment |
4. Certificate Planning | Model certificate requirement from verified emissions; monitor EU ETS prices quarterly; plan purchase timing for 1 Feb 2027 window | Finance / Treasury | Certificate exposure model; purchase plan; budget | Insufficient certificates purchased → shortfall at 30 Sep surrender |
5. Quarterly Review | Review embedded emissions against import volumes; update certificate exposure model; escalate data gaps | Compliance Owner | Quarterly compliance dashboard; escalation log | Late identification of shortfall; insufficient time to correct before 30 Sep |
6. Annual Declaration | Prepare and submit Art. 6 declaration by 30 Sep; confirm certificate surrender count matches verified emissions | Compliance Owner | Submitted declaration; surrender confirmation | Missed deadline or inaccurate declaration → Art. 26(1) at €100/tCO₂e |
7. Internal Audit | Pre-declaration compliance review; inspection readiness test; documentation check against Inspection Readiness Matrix™ | Internal Audit | Audit report; corrective actions list | Undetected errors discovered by competent authority during inspection |
8. Board Assurance | Quarterly board reporting on compliance status, financial exposure, and certificate position via CBAM Executive Dashboard™ | Compliance Owner | Board report; risk register update | Inadequate resource allocation; exposure underestimated at executive level |
Internal Controls Are the Mechanism That Prevents Legal Obligations from Becoming Penalty Events
FINDING: The European Commission requires accurate embedded emissions reporting, certificate surrender, and supporting documentation under Regulation (EU) 2023/956 and Implementing Regulation (EU) 2025/2546, but leaves the design of internal controls entirely to the importing organisation.
SO, WHAT: Two importers with identical legal obligations can face materially different penalty risk profiles depending on the quality of their internal controls: organisations with effective controls identify and correct errors before the declaration deadline; those without discover errors only when the competent authority does.
NOW WHAT: Implement the Internal Controls Checklist below as a gap assessment tool, assigning an owner and completion date to each control before 31 December 2026.
Table 13: Internal Controls Checklist
Control | Owner | Frequency | Evidence Output | Penalty Risk if Absent |
Supplier emissions data mandate — contractual obligation on all CBAM-covered suppliers to provide verified embedded emissions data | Procurement | Per supplier agreement | Updated supplier contracts | Unverified data → declaration error → Art. 26(1) at €100/tCO₂e |
Monthly import reconciliation — reconcile CBAM-covered imports against embedded emissions estimates | Customs + Compliance | Monthly | Reconciliation log | Undetected shortfall compounds across the full 2026 compliance year |
Certificate exposure model — quarterly update of certificate requirement vs. certificates held | Finance | Quarterly | Updated certificate model | Shortfall identified too late to correct before 30 September 2027 |
Verification appointment — accredited verifier engaged; scope confirmed for 2026 data under Reg. (EU) 2025/2546 | ESG / Compliance | Annual | Verifier appointment letter; scope agreement | Unverified emissions → invalid declaration → Art. 26(1) |
Evidence repository — central store of all CBAM compliance documents: supplier data, customs records, verification reports, certificates | Compliance Owner | Ongoing | Document management log | Unable to demonstrate compliance during competent authority inspection |
Management approval gate — executive sign-off on annual declaration before submission | CFO / Director | Annual | Signed declaration approval record | Unauthorised submission; governance failure at board level |
Internal audit review — pre-declaration audit of compliance data, controls, and documentation | Internal Audit | Annual | Audit report; open findings list | Undetected errors reach competent authority before importer can self-correct |
Regulatory monitoring — quarterly review of Commission and national competent authority guidance updates | Legal / Compliance | Quarterly | Regulatory update log | Missed implementing regulation changes → incorrect methodology → Art. 26(1) |
Retention policy — document retention for all CBAM evidence (minimum five years recommended pending Commission guidance) | Compliance Owner | Annual review | Retention policy document | Inability to produce evidence during inspection or appeal against penalty assessment |
Inspection Readiness Depends on Evidence Being Organised, Owned, and Retrievable in Advance
FINDING: National Competent Authorities administer Authorised CBAM Declarant authorisations, receive annual declarations, and are responsible for enforcement under Regulation (EU) 2023/956; Germany’s DEHSt has published CBAM guidance confirming inspection expectations, documentation requirements, penalty mechanisms, and the possibility of authorisation revocation for repeated serious infringements.
SO, WHAT: An importer who cannot produce required evidence promptly during a competent authority inspection is in a materially weaker compliance position: the ability to cooperate with authorities is an explicit factor in Article 26(2) penalty determination, and extended investigations compound both financial and reputational exposure.
NOW WHAT: Conduct an annual inspection readiness review at least 90 days before the 30 September deadline using the Inspection Readiness Matrix below, confirming that all required evidence is available, organised, and retrievable by the named document owner.
Table 14: Inspection Readiness Matrix
Evidence Type | Owner | Location | Retention (Recommended) | Review Frequency |
Authorised CBAM Declarant authorisation confirmation | Customs | Central CBAM repository | 5 years minimum | Annual |
Import records for all CBAM-covered goods (2026 compliance year) | Customs | Central CBAM repository | 5 years minimum | Annual |
Supplier embedded emissions documentation | Procurement | Central CBAM repository | 5 years minimum | Annual; updated per supply chain change |
Verification report — embedded emissions under Reg. (EU) 2025/2546 | ESG / Compliance | Central CBAM repository | 5 years minimum | Annual |
Emissions calculation methodology records under Reg. (EU) 2025/2547 | ESG | Central CBAM repository | 5 years minimum | Annual |
CBAM certificate purchase records | Finance | Central CBAM repository | 5 years minimum | Annual |
CBAM certificate surrender confirmation | Finance / Compliance | Central CBAM repository | 5 years minimum | Annual |
Annual CBAM declaration submission record | Compliance Owner | Central CBAM repository | 5 years minimum | Annual |
Carbon price paid in third country (where applicable) | Finance / Legal | Central CBAM repository | 5 years minimum | Annual |
Board approval of compliance programme and budget | Compliance Owner | Board minutes | 5 years minimum | Annual |
Board-Level Visibility into Certificate Exposure Is a Precondition for Adequate Compliance Resourcing
FINDING: Neither Regulation (EU) 2023/956 nor any Commission implementing regulation prescribes board-level reporting metrics for CBAM compliance — leaving organisations to define their own executive oversight framework for a financial obligation that can reach seven figures for large importers with significant certificate shortfalls.
SO, WHAT: Boards that receive fragmented or informal CBAM updates are more likely to under-resource compliance infrastructure, underestimate certificate exposure, and treat penalty risk as a remote contingency rather than a concrete financial planning input.
NOW WHAT: Compliance Managers should present the CBAM Executive Dashboard to the board at least quarterly from 1 January 2026 onward, using the seven KPIs below with RAG status and forward-looking exposure estimates, as a best-practice recommendation consistent with enterprise risk management standards.
Table 15: CBAM Executive Dashboard — Quarterly Board KPIs
KPI | Measurement | Reporting Frequency | RAG Guidance |
Certificate Coverage (%) | Certificates held ÷ estimated certificates required × 100 | Quarterly | Green: ≥90% | Amber: 70–89% | Red: <70% |
Imports in Scope | Total tonnage of CBAM-covered imports in the period | Quarterly | Green: All classified | Amber: Gaps identified | Red: Unclassified imports present |
Supplier Verification Status | % of suppliers with verified embedded emissions data | Quarterly | Green: ≥85% | Amber: 60–84% | Red: <60% |
Outstanding Emissions Data | Number of suppliers with missing or unverified data | Quarterly | Green: 0 | Amber: 1–5 | Red: >5 |
Declaration Readiness | Days to declaration deadline vs. completion status | Monthly (Q3 only) | Green: On track for recommended 31 Jul 2027 internal target | Red: Behind schedule |
Financial Exposure (€) | Estimated Art. 26(1) exposure at €100/tCO₂e if current shortfall not resolved | Quarterly | Green: €0 projected shortfall | Amber: <5% shortfall | Red: >5% shortfall |
Audit Findings | Number of open internal audit findings relating to CBAM compliance | Quarterly | Green: 0 open | Amber: 1–3 open | Red: >3 open or any critical finding |
Three Months of Structured Preparation Reduces the Risk of a 30 September Deadline Failure to Near Zero
FINDING: The first annual declaration and certificate surrender deadline of 30 September 2027 is fixed under Article 26(1) of Regulation (EU) 2023/956, and the European Commission confirmed in its 2026 guidance that importers should begin compliance preparations as early as possible — but provides no prescribed implementation roadmap for the organisational steps required before that deadline.
SO, WHAT: Organisations that begin compliance preparation fewer than 90 days before 30 September 2027 risk compressing verification, certificate procurement, management approval, and error correction into an inadequate timeframe — creating avoidable errors and elevated Article 26(1) exposure at €100/tCO₂e.
NOW WHAT: Launch the 90-Day Readiness Plan at least three months before any key compliance milestone — no later than 30 June 2027 for the first declaration — with ownership assigned before the first day of each phase.
Table 16: 90-Day Readiness Plan — Pre-Declaration Implementation Roadmap
Phase | Timing | Key Actions | Owner | Output |
Phase 1: Assessment & Governance | Days 1–30 | Compliance gap assessment; governance framework confirmed; CBAM Compliance Owner in place; board briefed; all in-scope imports identified; supplier data status reviewed | Compliance Owner + Board | Gap report; governance framework; board approval; in-scope import register |
Phase 2: Data & Verification | Days 31–60 | Supplier emissions data collection completed; accredited verifier engaged and working; embedded emissions calculation finalised under Reg. (EU) 2025/2547; certificate exposure model updated; purchase plan confirmed; finance budget approved | Procurement + ESG + Finance | Complete supplier data set; verifier working; verified emissions calculation; purchase plan approved |
Phase 3: Audit, Review & Submission | Days 61–90 | Internal audit of compliance data and controls; declaration draft reviewed by legal; management sign-off obtained; final certificate reconciliation; declaration submitted by 30 Sep 2027; surrender confirmed; evidence pack archived | Internal Audit + CFO + Compliance Owner | Audit report; signed declaration; certificate surrender confirmation; archived evidence pack |
8. Strategic Outlook 2026–2027
The Council’s Anti-Circumvention Focus Makes First-Cycle Compliance a Strategic Baseline for Future Enforcement
FINDING: On 12 June 2026, the Council of the European Union formally agreed its negotiating position to strengthen Regulation (EU) 2023/956, specifically targeting anti-circumvention measures, simplification for smaller importers, and preparation for future scope expansion — signalling that enforcement intensity and compliance expectations are set to increase as the regime matures.
SO, WHAT: The Council’s anti-circumvention focus indicates that national competent authorities will apply more rigorous scrutiny to supply chain structures, emissions data sources, and declaration accuracy in future compliance cycles — making the quality of first-cycle compliance in 2026 a strategic baseline that will influence subsequent enforcement posture.
NOW WHAT: Compliance Managers must ensure the systems and documentation quality deployed for the 2026 compliance year are inspection-ready — treating the first cycle as a precedent-setting compliance record, not a test run for the real regime.
European Commissioner Wopke Hoekstra stated on 17 December 2025 that the CBAM strengthening package
"prepares CBAM for the future at the heart of Europe’s clean and competitive transition."
Executive Vice-President Stéphane Séjourné described the reform as bringing
"crucial and long-awaited measures to ensure a level playing field between EU and non-EU industrial producers."
On 12 June 2026, Makis Keravnos, Minister of Finance of Cyprus representing the Council, confirmed that
"strengthening the CBAM and closing loopholes that can circumvent our rules is a key part in fulfilling" the EU’s climate commitments.
All three statements confirm that political commitment to rigorous CBAM enforcement is unanimous across the Commission and the Council.
Organisations that relied on estimated rather than verified emissions data during 2026, or that have not built systematic governance frameworks, face a narrowing window before enforcement scrutiny intensifies in the second and third compliance cycles.
Scope Expansion and Strengthened Verification Requirements Are Predictable Future Compliance Pressures
FINDING: EU institutions continue policy discussions on expanding CBAM to additional downstream products and goods produced from CBAM-covered commodities, as confirmed in the Council’s 12 June 2026 strengthening position, which explicitly references future scope expansion as a legislative objective.
SO, WHAT: An importer whose compliance system covers only the six current CBAM sectors — steel, aluminium, cement, fertilisers, hydrogen, and electricity — faces significant rework costs if scope expansion creates obligations for downstream products or additional sectors, particularly where the governance architecture was not designed to be extensible.
NOW WHAT: Design CBAM compliance architecture to be extensible from the outset — with supplier engagement processes, verification protocols, and reporting systems that can absorb new product categories without a full system rebuild when scope expansion is enacted.
Table 17: Emerging Compliance Risk Register
Risk | Source | Impact | Mitigation |
Downstream product scope expansion | Council 12 Jun 2026 position: future scope expansion confirmed as objective | High — new products require new data collection and supplier engagement | Build extensible compliance architecture; monitor Council and Commission publications quarterly |
Anti-circumvention enforcement | Council 12 Jun 2026 strengthening position — anti-circumvention is a named priority | High — supply chain structures scrutinised; penalties and possible authorisation revocation | Document supply chain legitimacy; maintain complete import records; legal review of complex supply structures |
EU ETS price escalation beyond 2025 range | EU ETS price volatility; 2025 range confirmed as €60–€80/tCO₂e per Commission data | High — directly increases certificate cost and Art. 26(1) penalty reference rate | Maintain ±20% sensitivity buffer in compliance budget; monitor EU ETS prices quarterly |
Member State enforcement divergence | Art. 26(2) penalties determined nationally; enforcement intensity may vary by Member State | Medium — different penalty profiles in different EU import markets | Monitor national competent authority guidance (e.g. DEHSt in Germany); take legal advice for major import markets |
UK CBAM penalty regime enactment | UK CBAM planned from 1 January 2027; penalty framework equivalent to Art. 26 still outstanding | Medium–High — UK importers face parallel compliance obligations once penalty rules are published | Monitor HMRC and GOV.UK publications; engage UK tax and customs advisers before 1 January 2027 |
Ten Actions Before 31 December 2026 Determine Whether 30 September 2027 Is Met or Missed
FINDING: The definitive EU CBAM regime combines legally enforceable obligations under Regulation (EU) 2023/956 and four implementing regulations, financial exposure under Article 26(1) at €100/tCO₂e, and operational responsibilities spanning customs, finance, procurement, and sustainability — all converging on a first compliance deadline of 30 September 2027.
SO, WHAT: Organisations that treat CBAM as a standalone customs or sustainability obligation risk fragmented accountability, underfunded controls, and avoidable Article 26(1) exposure in the first statutory compliance cycle.
NOW WHAT: Complete or formally initiate all ten strategic actions below before 31 December 2026 to achieve an inspection-ready compliance position by 30 September 2027.
Table 18: Top 10 Strategic Actions for Compliance Managers
Priority | Action | What to Do | Deadline |
1 | Confirm Authorised Declarant status | Verify authorisation through CBAM Authorisation Management Module; rectify any gap immediately | Immediately |
2 | Appoint a CBAM Compliance Owner | Name an individual with cross-functional authority across customs, finance, procurement, and sustainability; secure board mandate | Before end of Q3 2026 (recommended) |
3 | Engage all CBAM-covered suppliers | Issue formal supplier emissions data requests; update contracts to mandate verified data under Implementing Reg. (EU) 2025/2547 | Before 30 Sep 2026 |
4 | Appoint an accredited verifier | Engage an accredited verification body for 2026 embedded emissions data under Implementing Reg. (EU) 2025/2546 | Before 31 Oct 2026 |
5 | Build the certificate exposure model | Quantify embedded emissions estimate for 2026 imports; model certificate requirement at ±20% EU ETS price scenarios (€60–€80/tCO₂e reference range) | Before 31 Oct 2026 |
6 | Obtain board approval for CBAM budget | Present CBAM Budgeting Model™ to board; secure budget for certificates, verification, and compliance resource | Before 31 Dec 2026 |
7 | Implement the Internal Controls Checklist™ | Deploy all nine controls from Table 13; assign named owners; integrate into existing compliance framework | Before 31 Dec 2026 |
8 | Establish quarterly EU ETS price monitoring | Track EU ETS prices and Commission quarterly certificate price publications; update financial exposure model each quarter | Ongoing from Q3 2026 |
9 | Monitor regulatory developments quarterly | Track Commission and Council publications on Regulation (EU) 2023/956 amendments; update compliance framework for new implementing regulations | Ongoing from Q3 2026 |
10 | Launch the 90-Day Readiness Plan™ | Initiate Phase 1 no later than 30 June 2027 to achieve declaration readiness and certificate surrender by 30 September 2027 | No later than 30 Jun 2027 |
9. Frequently Asked Questions
FAQ 1: What happens if my company fails to surrender enough CBAM certificates by 30 September 2027?
Article 26(1) of Regulation (EU) 2023/956 requires the competent authority to impose a statutory penalty of €100 per tonne of CO₂e not covered by surrendered certificates — the EU ETS excess emissions rate confirmed under Article 16(3) of Directive 2003/87/EC. Paying the penalty does not discharge the certificate obligation: the missing certificates must still be purchased and surrendered separately. Both the €100/tCO₂e penalty and the certificate purchase cost run simultaneously, making a shortfall more expensive than full compliance in every scenario.
FAQ 2: How are EU CBAM penalties actually calculated?
The statutory formula under Article 26(1) is: Penalty = shortfall (tCO₂e) × €100/tCO₂e. An importer required to surrender 10,000 certificates who surrenders 9,000 faces a penalty of €100,000 (1,000 × €100), plus the obligation to purchase and surrender the remaining 1,000 at the prevailing market price (illustrative, using the statutory rate). The Table 8 Penalty Scenario Models in Section 5 apply this formula across six volume scenarios using a €70/tCO₂e certificate cost (within the 2025 EU ETS range of €60–€80 per tonne confirmed by the European Commission).
FAQ 3: Can my company correct an incorrect CBAM declaration before penalties apply?
The precise amendment procedure available to declarants who identify errors after submission — and the deadline by which self-correction avoids enforcement action — are not confirmed in the authoritative sources reviewed for this report. Check the latest guidance on the European Commission’s DG TAXUD CBAM page (taxation-customs.ec.europa.eu) and consult the national competent authority in your Member State of registration — for example, DEHSt in Germany — before submitting any declaration you believe may contain errors.
FAQ 4: What documents should my company retain in case of a competent authority inspection?
Competent authorities are expected to require: Authorised CBAM Declarant authorisation confirmation; import records for all CBAM-covered goods; supplier-provided embedded emissions documentation; the verification report from an accredited verifier under Implementing Regulation (EU) 2025/2546; CBAM certificate purchase and surrender records; and the submitted annual declaration. Germany’s DEHSt has confirmed that producing documentation promptly strengthens the compliance position. A minimum retention period of five years is recommended pending specific Commission guidance. The full document checklist appears in the Inspection Readiness Matrix, Table 14.
FAQ 5: What happens if my supplier provides incorrect embedded emissions data?
The legal obligation for declaration accuracy rests with the Authorised CBAM Declarant — not with the third-country producer. An EU importer who relies on incorrect supplier data and submits an inaccurate declaration faces the full Article 26(1) penalty exposure regardless of where the error originated. The specific conditions under which good-faith reliance on supplier data, combined with reasonable due diligence, might mitigate penalty exposure are not confirmed in the authoritative sources reviewed. Obtain legal advice on the due diligence defences available under the applicable Member State’s implementation of Article 26, and review Implementing Regulation (EU) 2025/2546 on verification obligations.
FAQ 6: What is the most effective way to minimise EU CBAM penalty risk before 30 September 2027?
Four actions, all completed before 31 December 2026 , provide the strongest defence against Article 26(1) exposure:
(1) verified embedded emissions data from all third-country suppliers, obtained and verified under Implementing Regulation (EU) 2025/2546 before 31 January 2027 ;
(2) a certificate exposure model updated quarterly throughout 2026 and reconciled against actual import volumes;
(3) an internal declaration readiness deadline no later than 31 July 2027 ; and
(4) the CBAM Penalty Prevention Framework embedded across customs, finance, procurement, and compliance functions. Organisations that complete all four before the close of 2026 are in the strongest position to meet 30 September 2027 without an Article 26(1) penalty.
10. References and Sources
1. Primary Legislation
European Parliament & Council — Regulation (EU) 2023/956 establishing a Carbon Border Adjustment Mechanism (10 May 2023). Available at: https://eur-lex.europa.eu/eli/reg/2023/956/oj/eng
European Commission — EU ETS Directive 2003/87/EC (as amended) — Article 16(3) Excess Emissions Penalty (Consolidated version). Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02003L0087
European Commission — Commission Implementing Regulation (EU) 2023/1773 (Transitional CBAM Reporting) (17 August 2023). Available at: https://eur-lex.europa.eu/eli/reg_impl/2023/1773/oj/eng
European Commission — Commission Implementing Regulation (EU) 2025/2546 (Verification of Declared Embedded Emissions) (10 December 2025). Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R2546
European Commission — Commission Implementing Regulation (EU) 2025/2547 (Methods for Calculation of Embedded Emissions) (10 December 2025). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism/cbam-legislation-and-guidance_en
European Commission — Commission Implementing Regulation (EU) 2025/2548 (Calculation and Publication of CBAM Certificate Prices) (10 December 2025). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism/cbam-legislation-and-guidance_en
European Commission — Commission Implementing Regulation (EU) 2025/486 (Authorised CBAM Declarant Status) (2025). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism/cbam-legislation-and-guidance_en
2. European Commission Guidance
European Commission (DG TAXUD) — CBAM Legislation and Guidance (Updated 2026). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism/cbam-legislation-and-guidance_en
European Commission (DG TAXUD) — Carbon Border Adjustment Mechanism – Definitive Regime (Updated 2026). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism_en
European Commission — CBAM Sectors Guidance (Updated 2026). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism/cbam-sectors_en
European Commission — First CBAM Certificate Price to be Published on 7 April (6 March 2026). Available at: https://taxation-customs.ec.europa.eu/news/first-cbam-certificate-price-be-published-7-april-2026-03-06_en
European Commission — Press Release: Simplifying and Strengthening CBAM (17 December 2025). Available at: https://ec.europa.eu/commission/presscorner/
European Commission — Proposal to Simplify and Strengthen the Carbon Border Adjustment Mechanism (Omnibus I) (2025). Available at: https://taxation-customs.ec.europa.eu/carbon-border-adjustment-mechanism/cbam-legislation-and-guidance_en
3. Council of the European Union
Council of the European Union — Council Moves to Strengthen the EU's Carbon Border Adjustment Mechanism (12 June 2026). Available at: https://www.consilium.europa.eu/en/press/press-releases/2026/06/12/council-moves-to-strengthen-the-eu-s-carbon-border-adjustment-mechanism/
4. National Competent Authorities
German Emissions Trading Authority (DEHSt) — CBAM Guidance and Sanctioning Information (Updated 2026). Available at: https://www.dehst.de/EN/Topics/CBAM/
5. UK Government Sources
HM Revenue & Customs — Prepare for the Carbon Border Adjustment Mechanism (CBAM) (16 July 2026). Available at: https://www.gov.uk/government/collections/carbon-border-adjustment-mechanism
HM Treasury / GOV.UK — Carbon Border Adjustment Mechanism – Policy Paper (16 July 2026). Available at: https://www.gov.uk/government/publications/introduction-of-carbon-border-adjustment-mechanism/carbon-border-adjustment-mechanism
UK Parliament — Finance Act 2026 – Part 5 (UK CBAM Primary Legislation) (2026). Available at: https://www.legislation.gov.uk/
HM Revenue & Customs — CBAM (Administrative Provisions) Regulations 2026 (2026). Available at: https://www.gov.uk/government/collections/carbon-border-adjustment-mechanism
HM Revenue & Customs — Carbon Border Adjustment Mechanism: Force of Law Notice and Reference Document (13 July 2026). Available at: https://www.gov.uk/government/collections/carbon-border-adjustment-mechanism
