As CBAM Enters Its Definitive Phase, Carbon Data Becomes a Supplier Requirement

The European Union's Carbon Border Adjustment Mechanism has crossed a line that many exporters hoped it would never reach. Having spent more than two years as a reporting exercise, CBAM moved into its definitive period at the start of 2026. The change matters less for the large European importers who are formally regulated than for the small and mid-sized manufacturers and processors in exporting countries who must now supply the numbers those importers are legally obliged to report.

Under the mechanism, importers bringing carbon-intensive goods into the EU must account for the emissions embedded in those goods and surrender CBAM certificates against them. The financial obligation phases in gradually between 2026 and 2034 as free allocation under the EU emissions trading system is wound down. But the administrative obligation is immediate, and it cannot be discharged without information that only the producer holds. For SME suppliers in cement, iron and steel, aluminium, fertilisers, electricity and hydrogen supply chains, verifiable emissions data is shifting from a nice-to-have sustainability credential into a commercial prerequisite.

The obligation sits in Europe; the data sits with suppliers

CBAM's transitional period, which ran from October 2023 to the end of 2025, was designed as a learning phase. Importers filed quarterly reports on embedded emissions, and default values were widely used as a stand-in where suppliers could not or would not provide actual figures. That flexibility has now largely gone. From 2026, importers must file an annual CBAM declaration. Where they rely on actual emissions rather than default values, those figures must be verified, and the declaration is due by the end of September following the reporting year.

The structure of the regime creates an unusual division of labour. The declarant is the EU importer, but the emissions arise at an installation in a third country, often several tiers back in a supply chain. An importer cannot verify what it cannot see. In practice, therefore, every EU buyer in scope must turn to its non-EU suppliers and ask for installation-level figures, production-route detail and evidence that the numbers have been checked by an accredited verifier.

Importers who cannot obtain that data face unpalatable choices: use conservative default values that overstate their liability, or find a supplier who can provide better information. Neither option is comfortable, and both push the same question back down the chain.

What smaller suppliers are actually being asked for

The requests arriving in suppliers' inboxes are considerably more granular than a corporate sustainability report. The core requirement is the specific embedded emissions of the goods being shipped, calculated at the level of the installation that produced them and according to the production route actually used.

• Installation-level figures, not company-wide averages. A group with four plants cannot satisfy a customer with a single blended number.
• Production-route detail: whether steel was made through a blast furnace or electric arc route, the clinker content of cement, whether aluminium is primary or secondary, and the feedstock path for fertilisers and hydrogen.
• Direct emissions from the production process, and indirect emissions from purchased electricity where the rules require them, as they do for cement and fertilisers.
• Precursor data for more complex goods, which may require figures from upstream suppliers of intermediate materials.
• Third-party verification by a body accredited for the purpose, backed by a monitoring methodology and a documented audit trail.

Generic claims do not travel well through this process. A net-zero target, a renewable energy certificate or an offset purchase cannot be substituted for a verified emissions figure. Nor can carbon credits be used to reduce the embedded emissions declared. The regime is deliberately constructed around measured data at the point of production, and suppliers who respond to questionnaires with marketing language will find themselves asked again, more firmly.

The cost and capability gap

The burden falls unevenly. Large industrial groups typically already operate emissions accounting systems, employ dedicated staff and treat verification as a routine line item. Smaller firms often do not. Plant data may sit in utility bills, spreadsheets and the heads of long-serving engineers. Metering may not align with the installation boundaries the methodology requires. Energy purchased as an intermediate product may be recorded in a form that cannot easily be converted into the categories a verifier needs.

Verification itself carries a cost, and it is a recurring one rather than a one-off. Add the expense of improving metering, the time required to build internal capacity and the difficulty of extracting data from upstream precursor suppliers, and the gap between a well-prepared competitor and an unprepared one becomes stark.

The commercial risk is not usually a formal ban. It is quieter than that. European buyers consolidating supplier lists, writing data-provision clauses into framework agreements and scoring tenders on carbon performance will gradually steer volume towards the suppliers who can answer questions promptly and credibly. Firms without numbers are not excluded in a single decision; they are designed out over several procurement cycles.

Simplification measures have narrowed the number of importers directly in scope. A mass-based annual threshold removes many smaller importers from the declaration requirement, and certificate purchases have been deferred. That relief is real, but it is narrower than it appears. Large buyers continue to request emissions data contractually, both because they fall within the regime at group level and because their own corporate disclosure obligations push in the same direction.

Verified data as a commercial asset

For suppliers that move early, the same data that satisfies a CBAM request does other work. It supports faster responses to customer questionnaires, which shortens sales cycles. It provides evidence in tenders where carbon intensity is now a scored criterion. It strengthens applications for sustainability-linked finance, where lenders tie pricing to emissions performance and increasingly expect borrowers to report at asset level.

There is also a defensive dimension. The EU regime is the first of its kind, not the last. The United Kingdom has signalled a carbon border mechanism of its own, and other jurisdictions are studying the model. Corporate disclosure rules are pushing large buyers to collect data from their supply chains regardless of border measures. A supplier that has built a verified, installation-level dataset in 2026 is positioned to reuse it repeatedly; a supplier that treats each request as a fresh emergency will keep paying the same cost.

A practical readiness path for SME leadership

Readiness is mostly a matter of sequencing rather than sophistication. A workable path for management teams runs through several steps.

1. Map exposure. Identify which products fall within CBAM's scope, which installations produce them and which customers have already begun asking questions.
2. Assign ownership. Name an individual or small team responsible for emissions data, with a budget and a mandate that crosses finance, operations and sales.
3. Engage a verifier early. A preliminary review will reveal where metering, records or methodology fall short while there is still time to fix them.
4. Build the data system. Align metering and activity records with the installation boundaries and emission factors the methodology requires, and keep the audit trail intact.
5. Clarify contracts. Settle with customers who bears verification costs, how confidential plant data is handled and how the figures may be used.
6. Reuse the output. Design one dataset to serve CBAM declarations, customer questionnaires, lender requests and voluntary disclosures rather than rebuilding it each time.

The definitive phase of CBAM turns an abstract climate policy into a procurement question. European buyers need verified numbers, and they will increasingly buy from suppliers who can provide them. For SME manufacturers and processors in exporting countries, the choice is between treating carbon data as a sales and financing asset and treating it as paperwork. The first group keeps its European customers. The second spends the next few years explaining why it cannot answer the question.