ANALYSIS · 1 October 2023
Legal Risk of Emissions Data During the CBAM Transitional Period
Under Regulation (EU) 2023/956, the reporting obligation rests with the EU importer or, in certain cases, the indirect customs representative. The accuracy of the report, however, depends on data supplied by the production installation in a third country. This separation between the legal duty bearer and the actual data source creates a distinct compliance risk in cross-border supply relationships.
The transitional regime beginning on 1 October 2023
Regulation (EU) 2023/956 establishing the Carbon Border Adjustment Mechanism (CBAM) set the transitional period from 1 October 2023 to 31 December 2025. During that phase, importers’ obligations were limited to the reporting duties under Articles 33 to 35; the surrender of CBAM certificates was not yet part of the transitional regime. Commission Implementing Regulation (EU) 2023/1773 specified the content, methodology and operation of the reporting system. What may initially appear to be a technical carbon calculation therefore requires customs classification, installation data, contractual information flows and internal controls to operate together.
Scope begins with the CN code
CBAM scope is determined not merely by a product’s commercial description but by the Combined Nomenclature (CN) codes listed in Annex I to Regulation (EU) 2023/956. A connection with iron and steel, aluminium, cement, fertilisers, electricity or hydrogen is therefore not sufficient by itself. The customs classification and production process of the particular goods must be examined together. An incorrect CN code may exclude goods that should be covered or lead to reporting under the wrong data method. The scope assessment should not be left solely to sales or sustainability teams; customs, technical and legal functions need a verifiable decision chain.
The legal addressee and the actual data producer are different
During the transitional period, the EU importer is generally the reporting declarant. Where an importer established in a Member State appoints an indirect customs representative and that representative agrees, the duty may pass to the representative. If the importer is not established in the Union, the reporting obligation rests with the indirect customs representative. By contrast, the operator of an installation in Türkiye or another third country is not the direct addressee of these reporting rules. Yet essential information – imported quantities, installation and production route, direct and indirect embedded emissions, and any carbon price due in the country of origin – depends substantially on the operator’s data. This division between the public-law duty and the place where data is actually generated is the structural risk at the centre of CBAM compliance.
Emissions data is more than a calculation result
The reliability of reported embedded emissions depends on the correct definition of installation boundaries, production processes, activity data, emission factors and, where relevant, precursor inputs. Supplying one aggregate emissions figure is not enough. It must be possible to trace the figure to a product and production line, reporting period and calculation method, as well as to the underlying records. A local monitoring or reporting method used in a third country is not automatically equivalent to the CBAM methodology. Existing environmental or sustainability data must therefore be mapped to the EU method, with methodological differences, assumptions and data gaps expressly documented.
Incomplete or incorrect data becomes a contractual risk
The fact that a third-country producer is not itself the reporting declarant under these EU rules does not make data quality less important. Incomplete, late or unverifiable information may prevent the EU importer from submitting a timely report, cause an incorrect or incomplete report, and trigger a correction procedure. Supply contracts should therefore define the required dataset, calculation method, reporting schedule, supporting records, correction duties, audit or information rights, and allocation of risk between the parties. These are not clauses directly mandated for every contract by the Implementing Regulation. They are contractual compliance tools designed to make the public-law reporting risk manageable between the participants.
An internal chain of duties and controls is required
An effective CBAM system cannot be reduced to a calculation performed by a single sustainability specialist. The customs function should verify the product code and import data; technical teams should control installation, process and activity data; and legal and compliance functions should monitor the identity of the duty bearer, choice of method, contractual information rights and correction procedures. Records should identify who prepared and reviewed the data, which document was relied upon and who approved the report. Predefined escalation and decision mechanisms are needed for unusual values, data gaps and methodological changes. This structure prevents errors and, in the event of review, demonstrates due care and clearly delimited areas of responsibility.
Correction and penalties must be assessed against actual responsibility
Implementing Regulation (EU) 2023/1773 provides for penalties where the reporting declarant fails to submit a CBAM report or fails to correct an incorrect or incomplete report after the competent authority initiates the correction procedure. The indicative amount in the 2023 text was EUR 10 to EUR 50 per tonne of unreported emissions; relevant factors included the extent and duration of the breach, intentional or negligent conduct, cooperation and remedial action. Personal responsibility inside a company cannot, however, be based on title or hierarchy alone. The inquiry must identify who classified the goods, produced and reviewed the data, knew of an error, held the power to correct it and used or failed to use the available means of intervention.
Conclusion: CBAM is also a matter of data governance
The CBAM transitional period transformed carbon calculation into a cross-border legal and compliance process. Because the EU reporting declarant and the third-country data producer are different persons, the parties need a clear information standard and companies need a documented internal control system. Effective compliance should not spread responsibility indiscriminately across an organisation. It should make product scope, data source, review steps and correction powers traceable. This protects both the reliability of environmental information and the correct attribution of responsibility to a particular person and conduct.
Archive note: This article is a retrospective analysis of the legal framework applicable when the CBAM transitional period began on 1 October 2023. Later legislative developments and current obligations should be assessed by reference to the versions of the relevant legal acts then in force.