CBAM definitive regime record-keeping, documentation retention and audit readiness for importers

CBAM Record-Keeping and Audit Readiness: The Importer's Practical Guide

Last updated · August 5, 2026

Most conversations about CBAM compliance focus on the annual declaration - the 30 September deadline, the certificate surrender, the verification report. Those things matter enormously. But they are the output of a process that has to run continuously, shipment by shipment, all year long. If your documentation isn't in order when a National Competent Authority (NCA) comes knocking, the declaration you filed won't save you.

This guide is about the discipline that sits behind the declaration: what records you must keep, how long you must keep them, what an NCA audit actually looks at, and how to build a data trail that holds up - not just in September 2027, but for the four years after that.

Why "Filing the Declaration" Is Not the End of the Story

Under Article 8(6) of Regulation (EU) 2023/956, CBAM records must be maintained in audit-ready condition for at least four years after the declaration year. That means every piece of evidence behind your first annual declaration - covering 2026 imports and filed by 30 September 2027 - must still be retrievable and coherent in 2031.

That four-year window is not a formality. NCAs monitor compliance through the CBAM Registry and can initiate audits or verification procedures at any point during it. The information reviewed by the NCA - which may impose penalties on declarants - flows directly from what you submitted and what you can substantiate behind it.

Authorised declarant status is not an administrative formality - it constitutes a continuous compliance commitment. Once authorised, declarants carry ongoing responsibilities extending beyond declaration filing: maintaining the CBAM Registry account, purchasing and holding sufficient certificates throughout the compliance year, submitting verified annual declarations, surrendering certificates by the deadline, and cooperating with any audit or verification activity initiated by the competent authority.

The practical implication: you cannot treat CBAM as a once-a-year scramble. The audit trail must be built continuously - per shipment, per installation - because the NCA can request it at any time, and records must survive four years.

What the Annual Declaration Actually Requires You to Have Documented

Before you can understand what to retain, it helps to understand what the declaration demands. The annual CBAM declaration must be submitted through the CBAM Definitive Registry by 30 September of the year following the import year, covering all CBAM-covered goods imported during the preceding calendar year. For 2026 imports, that deadline is 30 September 2027.

The declaration is not a summary figure. It requires granular detail on every CBAM-covered import during the calendar year - quantities, CN code classifications, countries of origin, and installation-level production data, plus additional data fields that feed directly into emissions calculations. Specifically, for each import shipment, five data points must be recorded at the time of import: the CN code of each product, the net mass in tonnes (or MWh for electricity), the country of origin under EU customs origin rules, the name and postal address of the production installation where the goods were produced, and the production route used.

That last point - production installation - is critical. CBAM is not calculated at the country or product level alone; it is calculated at the level of the specific facility that made the goods. If you cannot trace a shipment back to a named installation, you cannot file accurately, and you cannot defend your figures in an audit.

The Four Document Categories You Must Retain

Think of your CBAM documentation as four interlocking layers. Each layer supports the one above it. An NCA auditor will expect to be able to move from your declaration figures all the way down to the underlying source data.

1. Import and Customs Records

Your starting point is the customs declaration for each shipment. This establishes the CN code, the country of origin, the net mass, and the date of import. Customs authorities automatically share import data with the CBAM Registry, but you remain responsible for the accuracy of that data - and for retaining your own copy.

Keep: customs import declarations, commercial invoices, bills of lading or airway bills, certificates of origin, and any correspondence that establishes the production installation. CN code misclassification is one of the most common and most consequential reporting errors, because it affects every downstream calculation - auditors check these first.

2. Embedded Emissions Data and Calculation Evidence

This is the most technically demanding layer. For each installation supplying CBAM goods, you need to document the specific embedded emissions figure used in your declaration, and the evidence behind it.

If you are using actual values (verified installation-level data from your supplier), retain: the supplier's operator emissions report, the monitoring plan used to generate it, the underlying measurement data (energy bills, fuel consumption records, production volumes, meter readings), and the chain-of-custody documentation for any precursor materials. The emissions report is a technical compliance document that allows a verifier - or an NCA - to trace what was monitored, how calculations were done, and what data sources were used.

If you are using default values (the Commission's published figures under IR (EU) 2025/2621), the documentation requirement is different but equally important. Where default values have been used, evidence that verified supplier data was requested and could not be obtained will be required. Document that a data request was made and was not fulfilled, apply the applicable default value including the mark-up, and retain that paper trail. Default values carry a 10% mark-up in 2026, rising to 30% by 2028 - so there is a growing financial incentive to pursue actual data, and a growing audit risk if you cannot show you tried.

If your data is incomplete, inconsistent, or unverifiable, an accredited verifier will recommend default values for those emission streams — significantly increasing your CBAM certificate cost exposure. Build your data collection processes now, not in Q3 2027.

3. The Accredited Verifier's Report and Supporting Evidence

Third-party verification of embedded emissions by an accredited verifier is mandatory before filing when using actual values; importers must keep the verifier's report and all supporting evidence. Under CBAM, importers must submit annual declarations based either on actual verified emissions data or on default emissions values. In the case of actual emissions, the verification must be carried out by independent verifiers accredited by EU national accreditation bodies - self-reported figures that have not been independently verified are not accepted.

Accredited CBAM verifiers review the monitoring approach, emissions calculations, and supporting evidence. Following the assessment, they issue a verification report which is included in the CBAM declaration. Retain: the full verification report, the verifier's accreditation certificate (confirming they are recognised by a National Accreditation Body under EN ISO/IEC 14065), any pre-verification correspondence, and the supporting evidence package the verifier reviewed.

The verification engagement typically takes 4-8 weeks for a first-time installation audit. That timeline means you cannot wait until August to start the process for a September declaration.

4. Certificate Management Records

Your CBAM Registry account records certificate purchases, holdings, and surrenders automatically - but you should maintain your own parallel record. Retain: purchase confirmations for each certificate acquisition, quarterly holding calculations (you must hold at least 50% of your estimated annual certificate requirement each quarter from 2027), and the final surrender confirmation for each declaration year.

Failure to surrender the required number of certificates results in a penalty of €100 per excess tonne of CO₂, and paying the fine does not exempt the declarant from the obligation to surrender the missing certificates. That means non-compliance costs you the certificate price plus the penalty - a significant double hit.

Building the Governance Model

Documentation doesn't organise itself. The companies that will be audit-ready in 2028 are the ones building structured internal processes now. CBAM touches multiple functions - customs, procurement, finance, sustainability - and without clear ownership, data falls through the gaps.

A practical governance structure assigns clear roles:

CBAM Compliance Lead - overall programme ownership, Registry account management, declaration sign-off
Customs / Trade Compliance - CN code accuracy, import declaration data, customs authority liaison
Procurement / Supply Chain - supplier engagement, data collection, monitoring plan review, verifier coordination
Finance - certificate purchase planning, quarterly holding calculations, liability accrual, audit liaison

CBAM reporting should be integrated with customs, finance, and procurement systems. Clear ownership, review processes, and escalation paths reduce the risk of inconsistent submissions. Supplier contracts may need to include data sharing obligations, audit rights, and consequences for non-cooperation - suppliers that cannot provide credible emissions data introduce compliance risk that lands on you, not them.

SAP's analysis of the definitive regime frames this well: applying finance-grade governance to carbon, enabling ledger-based planning for carbon exposure, and achieving end-to-end traceability and reconciliation across carbon and financial reporting are the hallmarks of a CBAM-ready organisation.

The per-shipment habit. The most effective audit-readiness practice is simple: capture and file the five required data points (CN code, net mass, country of origin, installation name/address, production route) for every shipment at the time of import — not retrospectively. Retrospective reconstruction is both time-consuming and unconvincing to an auditor.

What an NCA Audit Actually Looks Like

NCAs monitor compliance via the CBAM Registry and enforce penalties for non-compliance. The information flows from declarant to the European Commission and is then reviewed by the NCA. In practice, an NCA audit or verification request is likely to focus on:

Declaration accuracy - do the figures in your declaration match your underlying import records and emissions data?
CN code classification - are your goods correctly classified? Misclassification cascades through every downstream calculation.
Emissions data provenance - can you trace each embedded emissions figure back to a named installation, a monitoring plan, and either a verifier's report or a documented default-value decision?
Default value justification - if you used defaults, did you genuinely attempt to obtain actual data first?
Certificate holding compliance - did you maintain the required quarterly holding levels?
Record completeness - are all records present, coherent, and retrievable for the full four-year retention period?

Importers should be able to demonstrate how embedded emissions were calculated, which data sources were used, and how data aligns with customs declarations. This documentation must be available during inspections, not recreated after the fact.

Your Practical Audit-Readiness Checklist

Use this as a living document - review it quarterly, not just before the September deadline.

Import records

Customs declaration retained for every CBAM shipment
CN code verified against TARIC database and documented
Country of origin confirmed under EU non-preferential origin rules
Production installation name, address, and production route recorded at time of import

Emissions data

Actual values: operator emissions report and monitoring plan received and filed
Actual values: underlying measurement data (meter readings, fuel records, production volumes) retained
Default values: written evidence of data request to supplier and non-response retained
Default values: applicable default figure and mark-up documented with source reference

Verification

Accredited verifier engaged with sufficient lead time (allow 4-8 weeks minimum)
Verifier's accreditation certificate on file
Full verification report retained alongside supporting evidence package

Certificate management

Quarterly holding calculations documented
Certificate purchase confirmations retained
Surrender confirmation retained after each declaration year

Governance

Named CBAM Compliance Lead with documented authority
Cross-functional CBAM working group with defined roles
Supplier data-sharing obligations included in contracts
Four-year retention policy formally adopted and communicated
Annual internal review of declaration accuracy scheduled

An Interactive Audit-Readiness Self-Assessment

Use the tool below to score your current documentation posture across the five key audit dimensions. It takes about two minutes and gives you a prioritised gap list.

The Practical Takeaway: Build the Trail Continuously

The single most important shift in mindset for CBAM compliance is this: the audit trail is not something you assemble before 30 September. It is something you build continuously, shipment by shipment, supplier by supplier, throughout the year.

The four-year retention requirement means that every piece of evidence behind your 2026 declaration must still be coherent and retrievable in 2031. The NCA can request it at any point in that window. The penalty for failing to surrender the right number of certificates is €100 per tonne - on top of still having to surrender them. And the penalty for importing without authorisation is three to five times higher still.

None of that is designed to frighten you. It is designed to make the case for treating CBAM documentation the way you treat financial records: as a continuous, governed, auditable discipline - not a year-end exercise.

The companies that will find the 30 September 2027 deadline manageable are the ones that spent 2026 building the data backbone, not the ones that start collecting supplier data in July.