In December 2025, the EU adopted several implementing regulations governing the definitive (obligation) phase of the Carbon Border Adjustment Mechanism (CBAM), as well as a proposal to extend CBAM’s scope in the future. Several key provisions of this extensive regulatory package (approx. 5,000 pages) apply across all EU Member States as of 1 January 2026.
What does this mean for companies?
CBAM’s definitive phase has started on 1 January 2026. Companies affected by CBAM should urgently assess the impacts of the rules and prepare an action plan structured into immediate, medium-term, and long-term strategic objectives.
As a first step, a company must determine whether it imports from outside the EU goods covered by the CBAM Regulation (e.g., certain iron and steel goods, aluminium and cement goods, fertilisers, as well as hydrogen and imported electricity) and whether the volume of such imports exceeds the mass-based 50-tonne threshold. For hydrogen and imported electricity, there is no import threshold; the importer is automatically subject to CBAM obligations.
If a company’s imports of CBAM goods exceed the applicable thresholds in 2026, the importer must submit an application for authorised CBAM declarant status. The application must be pending with Customs no later than 31 March 2026. According to Finnish Customs, processing may take several months. If an importer has no authorised CBAM declarant status and the threshold has been exceeded, Customs will prevent the import of CBAM goods. CBAM goods cannot be released for free circulation until the importer has obtained authorised CBAM declarant status.
Key elements of the CBAM regulatory package
1. Implementation of emissions calculation methods and determination of default values
Commission Implementing Regulation (EU) 2025/2547 sets out detailed emissions calculation methodologies and application rules that all companies within CBAM’s scope must apply when calculating embedded emissions. Commission Implementing Regulation (EU) 2025/2621 establishes the rules for using CBAM default values where actual values based on supplier and input (precursor) emissions data are not used or are not available. Default values are defined based on CN codes and the country of origin. For goods other than electricity, default values include a markup to account for potential deviations in cases where the emissions of an individual installation exceed the relevant average emissions intensity in the producer country.
What does this mean for companies?
If you do not obtain verifiable (i.e., capable of being verified by a verifier) emissions information from your supplier, embedded emissions will typically need to be determined using default values set by the Commission. Going forward, a general estimate of emissions is no longer sufficient; CBAM implementing rules require documented data on a product, production process, or installation basis, depending on the case—especially for complex goods and precursors. The choice between default values and actual emissions data can significantly affect a company’s CBAM costs. Using actual values, an annual steel import volume equivalent to 8,000 tonnes could generate cost savings of over EUR 1 million. When estimating costs, companies should consider whether default values or actual values result in higher overall costs.
2. Verification of emissions data
Commission Implementing Regulation (EU) 2025/2546 requires companies to collect and document emissions data systematically for the purposes of verification (supplier data plus supporting documentation). In the first verification year, verifiers must carry out an on-site visit at the installation where the relevant goods are produced. In the second consecutive year, the verifier may replace the physical visit with a virtual visit or omit the visit. In all cases, however, an on-site visit must be carried out at least every other year.
What does this mean for companies?
During 2026, companies should identify an accredited verifier if they intend to use actual emissions data. Merely collecting CBAM emissions data from suppliers will no longer be sufficient; companies must also be able to demonstrate and substantiate the roles, processes, and documentation used to collect emissions information. Accredited verifiers’ physical on-site audits impose strict requirements on process management and documentation, both for companies and for their suppliers’ production installations. Embedded emissions data and any carbon price paid in the country of origin must be verified by accredited verifiers.
3. Pricing of CBAM certificates
Commission Implementing Regulation (EU) 2025/2548 sets out how the Commission determines and makes available the price of CBAM certificates to CBAM declarants. Pricing is based on the auction prices of EU ETS allowances for the relevant CBAM product categories. In 2026, certificate prices are published as quarterly averages, and from 2027 onwards as weekly averages.
What does this mean for companies?
The purchase of certificates will take place starting in 2027, based on imports made in 2026, which means CBAM becomes a genuinely budgetable cost item. Procurement and pricing practices, as well as supplier contractual terms, should be updated to reflect expected future CBAM auction-linked certificate costs.
4. Oversight of CBAM data
Commission Implementing Regulation (EU) 2025/2619 specifies what information national customs authorities must provide to the Commission. It also sets the reporting frequency and the mechanisms for linking customs data to the CBAM Registry for checks of company-reported data.
What does this mean for companies?
Oversight of CBAM data will become stricter. Reporting and verification require a documented “audit trail” in which the CN codes, import quantities, CBAM declarations, and the contents of purchased certificates must reconcile. If a company’s reported CBAM data are non-compliant or the number of certificates purchased does not correspond to the product-specific embedded emissions of imported goods, the company may face administrative penalties and potentially other sanctions. Customs authorities have the right—subject to applicable confidentiality rules—to obtain the information necessary to carry out oversight from entities subject to CBAM obligations.
5. Adjustment for free allocation of EU ETS allowances
During the transitional period, EU producers of CBAM goods under the EU ETS have received a share of allowances for free. Commission Implementing Regulation (EU) 2025/2620 sets out the free allocation adjustment to ensure that imports are not immediately subject to the full carbon cost while certain EU producers still benefit from free allocation. The regulation defines how this allowance-based adjustment is calculated—i.e., how free allocation affects the number of CBAM certificates that must be surrendered. The free allocation adjustment may be based on actual data or determined using default CBAM benchmarks set out in an annex to the regulation.
What does this mean for companies?
When calculating how many CBAM certificates your company must surrender, the calculation may include a free allocation reduction. The EU will determine, by product group, the transitional free allocation reduction and apply it—under the prescribed methodologies—to the quantities of CBAM goods imported by your company.
6. Changes to authorised CBAM declarant procedures and the use of the CBAM Registry
Commission Regulation (EU) 2025/2549 amends and corrects rules governing the conditions and procedures for authorised CBAM declarant status. Commission Regulation (EU) 2025/2550 updates the content and processing rules of the CBAM Registry and clarifies access rights. The new rules harmonise and safeguard the use of the Registry, facilitate the granting of access rights, and improve data exchange between the Commission and competent authorities.
What does this mean for companies?
Applying for and maintaining authorised CBAM declarant status for CBAM imports will be handled under the updated rules—incorrect role allocation or incomplete applications may, in the worst case, interrupt a company’s imports entirely. CBAM compliance becomes increasingly registry driven. The CBAM Registry streamlines communication, notifications, registrations, and checks, and enables seamless exchange of information between the Commission, competent authorities, customs authorities, CBAM declarants, applicants, operators, and verifiers. Companies must therefore keep their Registry data accurate and compliant, as the information is checked by national authorities, accredited verifiers, and the Commission.
Commission proposal to extend CBAM scope
The December 2025 package also included a formal Commission legislative proposal to extend the scope of the CBAM Regulation. The core of the proposal is to extend CBAM particularly to downstream goods of steel and aluminium.
The Commission proposes extending CBAM to 180 additional customs headings, including:
- Iron and steel products, such as ores, sheet piling, railway materials, gas containers, and other products.
- Metal products, such as nets and fencing, nails, furniture fasteners, and plugs/closures.
- Machinery and equipment, such as engines, pumps, burners, refrigerators/freezers, industrial robots, cranes, winches, lifts, agricultural and household machinery, washing machines, tumble dryers, freezers, foundry and metalworking equipment, electric motors and transformers, as well as welding equipment and electrical conductors.
- Vehicles and parts, such as motor vehicles, chassis, wiring, vehicle bodies, gearboxes, wheels, freight and hand-propelled vehicles, and parts for trailers.
- Medical instruments, such as tubular needles and neurostimulation devices containing steel or aluminium; and
- Metal furniture and structures, such as metal-framed seats, metal office furniture, and prefabricated buildings containing steel or aluminium.
Other key proposed extensions include:
- Additional measures to prevent circumvention of CBAM obligations through enhanced oversight and monitoring.
- Inclusion of pre-consumer scrap aluminium and steel materials in the embedded emissions calculation of final CBAM goods as a relevant precursor input.
- Changes to the method for calculating emissions factors for imported electricity so that electricity generation from all sources is considered, including non-fossil sources; imported electricity default values would be revised accordingly.
The proposed changes related to electricity imports are intended to apply from 2026, and the product scope extension from 1 January 2028.
What does this mean for companies?
CBAM requirements may apply in the coming years to an increasing number of product groups and goods, significantly expanding the number of companies within scope. In addition to new companies, those already within scope should conduct a risk analysis and mapping exercise to assess how an expanded CBAM scope could affect their business and strategy.
How should your company respond now?
Questions companies should consider:
- Do Group companies import CBAM goods into the EU from third countries, and in what volumes?
- Is authorised CBAM declarant status required, and has it already been applied for?
- Should emissions calculations be based on default values or on actual emissions data going forward? How reliable is the current data basis for CBAM calculations?
- Can manufacturers/suppliers of CBAM goods calculate embedded emissions reliably and report them in a form that is verifiable? How will manufacturers be trained or contractually required to comply?
- Does the group have its own installations in third countries that must quickly begin planning emissions determination and supplier data collection for CBAM obligations?
- Is the key data source—customs import data—available, or can it be obtained frequently enough?
- How should CBAM be organised efficiently: centrally or decentralised? Which technology solutions help? Which process steps can be outsourced?
- Are processes in place for correct accounting treatment of CBAM costs in finance?
- Are CBAM costs also reflected commercially in both purchasing and sales?
- Have procurement and project contracts been updated to address CBAM obligations?
- If the company wants to hedge CBAM costs with financial instruments, are these lawful and what risks do they involve?
- Is CBAM sufficiently integrated into operational risk management?
- Have changes in carbon pricing been factored into company strategies (corporate, procurement, and investment strategies) and transactions (M&A)?
Priority actions
- Assess whether your company falls within the scope of CBAM.
- If the thresholds are exceeded, submit an application for authorised CBAM declarant status no later than 31 March 2026.
- Obtain CBAM-compliant emissions calculation data from suppliers and assess actual product-specific embedded emissions.
- Ensure that supplier emissions data are verifiable (processes, documentation).
- Consider CBAM certificate pricing and regulatory oversight in your company’s strategy and risk management.
How Sustashift can support your company in meeting CBAM obligations
We offer, for example, the following solutions:
- Scoping assessment of your company’s CBAM applicability – preliminary review of CBAM goods and CN codes, suppliers, countries of origin, plus monitoring against the 50-tonne import threshold;
- Comprehensive training package on the practical application of CBAM – aligned with all legal requirements of EU rules and tailored to your company’s needs;
- Supplier data management – a software solution including supplier data request templates under Commission Implementing Regulation (EU) 2025/2547, plus a documentation model supporting verification of emissions data;
- Assessment of CBAM eligibility of emissions data – review of supplier emissions data by experts trained in emissions calculation;
- Emissions calculator – a calculator aligned with EU rules for estimating CBAM cost impacts and the number of certificates to be purchased;
- Planning and delivery of the CBAM annual declaration – a roadmap for implementing the annual declaration based on calendar year 2026 emissions data, an information package on purchasing paid CBAM certificates, a critical-task checklist by responsible person, and a supplier risk analysis.
