CBAM Is Not a Compliance Problem. It's a Data Problem.

Most importers facing CBAM are thinking about it as a compliance exercise — something for the legal team, the customs broker, or the sustainability function to manage. The forms need to be filed, the certificates need to be purchased, the deadline needs to be met. This framing is understandable. It is also the reason so many organisations are struggling with it.

The organisations that will manage CBAM well are not the ones with the best compliance advisors. They are the ones that understood early that the compliance obligation is the easy part. The hard part is the data — and the data problem runs deep into the supply chain in ways that a compliance mindset does not prepare you for.

What CBAM Actually Requires

The mechanism is straightforward in principle. EU importers of covered goods — currently steel, aluminium, cement, fertilisers, electricity, and hydrogen — must report the embedded carbon emissions of those goods and, from 2026, purchase CBAM certificates corresponding to those emissions. The intent is to ensure that imported goods face the same carbon cost as goods produced under the EU Emissions Trading System.

The challenge is in the word "embedded." CBAM does not ask for an estimate or a sector average. It asks for actual emissions data at the level of the production installation — the specific facility where the goods were manufactured, using the specific processes used to make them. This data must be calculated according to EU methodology, reported by the operator of that installation, and from 2026, verified by an accredited third party. Generic ESG reports, lifecycle assessment data, and industry averages do not meet the requirement.

This means the compliance obligation lands not just on the importer, but on every supplier in scope. An EU steel importer's CBAM declaration depends on verified, installation-level emissions data from a steel producer in Turkey, India, or Ukraine who may have no established carbon monitoring practice, no familiarity with EU methodology, and no particular incentive to prioritise someone else's compliance deadline. DNV, which has worked extensively on CBAM verification, is blunt: supply chain emissions data is currently the single biggest blocker to compliance for EU importers.

The Invisible Problem CBAM Made Visible

Most importers were already operating without visibility into their suppliers' production processes. This is not negligence — it is how supply chains typically work. You buy a product at an agreed specification and price. How it was made, at what carbon intensity, using what energy sources, is not information that normally flows between counterparties.

CBAM did not create this gap. It made it consequential. The organisation that previously had no need to know the emissions intensity of its Turkish steel supplier now has a financial exposure that depends on that number. The supplier who previously had no reason to measure and report embedded emissions now needs to provide verified data on a schedule they may not be equipped to meet.

This is why CBAM cannot be solved by a compliance team working in isolation. The data needed to file a correct CBAM declaration is scattered across procurement systems, logistics records, and supplier relationships that span multiple functions. Getting it requires coordination across procurement, operations, sustainability, and IT — and it requires supplier engagement that is fundamentally different from the arms-length commercial relationships most importers are accustomed to.

The organisations currently struggling most with CBAM are the ones that treated the transitional period as a reporting exercise and discovered, when it came time to use primary data, that they had no systematic way to collect it. Companies that invested in supplier engagement before the reporting period — building communication channels, helping suppliers understand the methodology, creating structured processes for data collection — experienced materially fewer difficulties. This is the pattern with data problems: the investment looks optional until the deadline, and then the absence of it becomes urgent.

What "Data Ready" Actually Means for CBAM

Being data ready for CBAM is not about having a spreadsheet that tracks imports. It means having a reliable, repeatable process for collecting verified emissions data from each supplier in scope, in a format and at a level of detail that meets EU requirements, on a timeline that supports annual declaration.

In practice this requires several things that most organisations do not have in place. It requires knowing which suppliers are in scope — which means a product and HS code mapping exercise that is more complex than it sounds, particularly for importers with large and diverse supply portfolios. It requires a structured engagement process with each in-scope supplier that clearly communicates what data is needed, how it should be calculated, and in what format it should be delivered. It requires a validation process that can identify whether the data received meets EU methodology requirements, rather than simply trusting the supplier's submission. And it requires a system — ideally not a spreadsheet — that can aggregate data across multiple suppliers and declarations, maintain an audit trail, and support reuse across reporting periods.

None of this is technically complex. All of it takes time to build. The transitional period that ran from October 2023 to December 2025 was intended to give importers time to build exactly this infrastructure. Organisations that used it for operational preparation are now in a materially different position from those that treated it as an extended grace period.

The Scope Is Going to Expand

One more dimension of the CBAM data problem is frequently underestimated: the scope will expand. The European Commission is required to review and extend CBAM to additional sectors, including chemicals, plastics, and organic basic materials. The current categories are the starting point, not the boundary.

An organisation that has built its CBAM compliance infrastructure around the specific products currently in scope has built a point-in-time solution. When the scope expands, the infrastructure will need to expand with it — which means that the data collection processes, supplier engagement frameworks, and reporting systems need to be designed with extensibility in mind from the beginning. A solution that was adequate for the current scope but cannot absorb new product categories without a rebuild is not a compliance solution. It is a deferral.

The organisations that build correctly the first time build for the regulatory state that is coming, not the one that exists today. This is a design decision that needs to be made at the beginning of the infrastructure build, when it is cheap, not at the point of scope expansion, when it is not.

The Practical First Step

The right question for any organisation facing CBAM is not "what do we need to report this year?" It is "what data do we need, from which suppliers, in what format, and what would it take to collect it reliably and repeatedly?"

Answering this question honestly requires a supply chain mapping exercise, a supplier capability assessment, and a gap analysis between what data currently exists and what the reporting obligation requires. It is not glamorous work. It is also the work that determines whether compliance is achievable on the regulatory timeline, or whether the organisation is going to spend the coming reporting cycles in reactive mode — filing declarations using default values that overstate emissions, incurring penalty exposure, and rebuilding under pressure what should have been built systematically.

CBAM is a data problem with a compliance deadline. Organisations that understand this distinction plan differently. The ones that do not discover it when the declaration is due.