How to Run a CBAM Supplier Data Collection Process: A Step-by-Step Guide for EU Importers
Your first CBAM annual declaration covers 2026 imports and is due by 30 September 2027. The embedded-emissions figures you put in that declaration - and the certificate bill that follows - depend almost entirely on data you collect from your non-EU suppliers right now. Get it right and you pay for your actual carbon footprint. Get it wrong, or get nothing, and you fall back on default values that carry a built-in mark-up designed to hurt.
This guide walks through the operational process an EU importer (declarant) runs to collect that data: who to contact, what template to send, what good data looks like, and what to do when a supplier goes quiet.
This post focuses on the importer's data-collection workflow. For the supplier's side of the same process, see our CBAM for Non-EU Exporters guide. For the embedded-emissions calculation itself, see our embedded emissions and default values post.
Why actual data matters more in 2026 than it ever did before
CBAM is now in its definitive period. From 1 January 2026, every import of covered goods - steel, aluminium, cement, fertilisers, hydrogen, electricity - creates direct certificate cost exposure. The number of certificates you surrender is set by the embedded emissions you declare.
Default values exist as a fallback, but they are deliberately punitive. Under Implementing Regulation (EU) 2025/2621, default values carry a mark-up of 10% in 2026, rising to 20% in 2027 and 30% from 2028 onwards. That mark-up is there precisely to push importers toward actual data. For steel, the gap between a country-level default and a well-run mill's real emissions can be substantial: one analysis found that a Turkish BF-BOF steel mill with an actual emission intensity of 1.5 tCO₂e per tonne faces an unnecessary certificate cost when its shipments are assessed against a default value of 2.1 tCO₂e per tonne at current ETS prices.
The trajectory only gets steeper. The same default penalty that costs roughly €3.75 per tonne net in 2026 rises to approximately €72.75 per tonne net by 2030, when the CBAM factor reaches 48.5%. Suppliers who treat 2026 as low-stakes are underestimating a cost that compounds every year through 2034.
The 20% rule is now in force. Until July 2024, fallback/default values could cover up to 100% of a supplier's embedded emissions. That threshold dropped to 20% from July 2024. From January 2026, fully verified MRR-aligned actual data is expected across the board. Any reliance on defaults beyond permitted limits overstates your emissions and increases your certificate liability directly.
Step 1 - Map your in-scope products and suppliers
Before you send a single email, build a supplier map. For each CN code you import, identify:
- Which installation produced the goods (factory address, not just the trading company)
- Which CBAM sector it falls under (steel, aluminium, cement, fertilisers, hydrogen, electricity)
- Estimated annual tonnage - this tells you which suppliers drive the most certificate exposure
Prioritise by financial exposure, not alphabetically. A supplier providing 80% of your steel volume deserves more attention than one providing 2%. For complex goods (e.g. steel fasteners or aluminium profiles), remember that precursor emissions - the emissions embedded in the raw material inputs - must also be captured. If precursor data is missing, you can be forced back onto default values even if your tier-one supplier is fully verified.
Contact the right person at the supplier. Aim for someone responsible for environmental or energy data at site level — typically an environmental manager, energy manager, or sustainability lead. Avoid sending requests only to the sales contact; they rarely have access to installation-level emissions data.
Step 2 - Send the EU's official communication template (not a free-form request)
The European Commission publishes an official CBAM Communication Template for Installations - an Excel file designed to help importers gather the necessary emissions data from non-EU suppliers in a consistent, submission-ready format. Use it. Do not ask suppliers for free-form data or repurpose their ESG reports.
The Commission has also published filled-in example templates for each sector - cement, aluminium, fertilisers, hydrogen, and steel (blast furnace, EAF, screws and nuts) - so suppliers can see exactly what a completed return looks like. Share the relevant example alongside the blank template.
Your outreach message should include:
- The blank template (Excel) and the sector-specific filled example
- A plain-English explanation of what each field means
- A clear deadline (allow 6-8 weeks minimum; verification takes time)
- A short explanation of why this matters commercially (see below)
The "why" matters. Many non-EU suppliers don't yet understand that their EU customer's certificate bill is directly tied to the data they provide. A one-paragraph explanation - "if we can't use your actual figures, we fall back on country-level defaults that are marked up and cost more; that extra cost flows back into our commercial relationship" - converts more suppliers than a compliance-only request.
Step 3 - Understand what the template is asking for
The communication template is structured around the EU's Monitoring and Reporting Regulation (MRR) methodology. Suppliers (operators) must calculate emissions at installation level - not corporate averages - and allocate them to specific products and process units. The data must align with the Annex IV format set out in the CBAM Implementing Regulations.
In practice, a complete return covers:
| Data category | What you need |
|---|---|
| Installation identity | Name, address, production route (e.g. BF-BOF, EAF, dry-process kiln) |
| Reporting period | Calendar year (installation data is valid for 12 months) |
| Direct emissions (Scope 1) | Specific direct embedded emissions (tCO₂e per tonne of goods) |
| Indirect emissions | Embedded electricity consumption and applicable emission factor (required for cement and fertilisers) |
| Precursor emissions | Emissions embedded in input materials (e.g. iron ore pellets, alumina) |
| Calculation methodology | MRR tier level used, emission factors, activity data sources |
| Carbon price paid | Any carbon price already paid in the country of production (reduces your certificate obligation) |
| Verification status | From 2026, third-party verification by an accredited verifier is mandatory for actual values |
Reporting is done at the installation level - a unique manufacturing site - for a given reporting period, and on a tariff-code basis, not an individual product specification basis. If a supplier produces 50 different steel fasteners under the same CN code, they aggregate all production into one product line.
Step 4 - Validate what comes back
When a supplier returns the template, don't just file it. Run a completeness check before passing it to your verifier:
- All mandatory fields completed? In the Commission's Excel template, mandatory fields are highlighted. Any blank green cell is a problem.
- Emissions allocated to the right CN codes? Check that the product lines in the template match the goods you actually import.
- Default or fallback values disclosed? Suppliers are permitted to use approved fallback values for up to 20% of embedded emissions. If they've used more, the data is non-compliant.
- Methodology declared? The template should state the MRR tier level and emission factors used. "We used our own estimate" is not sufficient.
- Reporting period correct? A completed CBAM installation data file is valid for 12 months and does not need to be delivered alongside every order. But it must cover the calendar year for which you're declaring.
If data is incomplete, go back to the supplier with specific questions - not a general "please fix this." The more precise your follow-up, the faster you get a usable return.
Step 5 - Route verified data to your verifier
From 2026, reported actual embedded emissions must be verified by an accredited third party before they can be used in an annual CBAM declaration. This is not optional. Unverified actual data cannot replace default values in your declaration.
The practical implication: start your verifier relationship early. Verification queues are building as the September 2027 declaration deadline approaches. Your verifier will need the completed communication template, the supplier's monitoring plan, and supporting evidence for the figures reported.
There is also a digital shortcut worth knowing. The Commission's Operators of Third Countries Installations (O3CI) Portal, live since January 2025, allows non-EU installation operators to upload their emissions data centrally and share it directly with EU declarants - eliminating the need to submit separately to each customer. To use it, share your EORI number with the supplier so they can grant you access to their data in the Registry. If your key suppliers are not yet registered on the O3CI Portal, encourage them to do so - it reduces friction for both sides.
Step 6 - Handle non-responsive suppliers
Some suppliers will not engage, at least not quickly. Here's a practical escalation path:
- Resend with a commercial framing. Restate the cost consequence in concrete terms. A supplier who understands that non-response costs their EU customer real money - and that cost flows back to them through pricing or supplier substitution - is more likely to act.
- Offer support. Many non-EU manufacturers have never produced MRR-aligned data before. Offering to walk them through the template on a call, or pointing them to the Commission's official guidance document for non-EU operators (available in Arabic, Chinese, Hindi, Japanese, Korean, Turkish, and Ukrainian), removes a genuine barrier.
- Embed it in contracts. For ongoing supplier relationships, add a CBAM data clause to your purchase contracts - specifying the template format, the deadline, and the verification requirement. Preferred supplier status or commercial incentives can reinforce the right behaviour.
- Fall back to default values only as a last resort. If a supplier genuinely cannot or will not provide data, use the Commission's country- and product-specific default values from IR 2025/2621. Accept the mark-up, document your attempts to obtain actual data, and flag that supplier for review at the next procurement cycle.
The data-collection checklist
Use this as your running reference for each supplier engagement:
- Supplier mapped to specific installation (not just trading company)
- CN codes and annual tonnage confirmed
- Official EU communication template sent with sector-specific filled example
- Contact confirmed as environmental/energy manager at site level
- Deadline set (minimum 6-8 weeks from send date)
- Commercial rationale explained (default mark-up cost)
- Returned data checked for completeness (all mandatory fields, correct CN codes, ≤20% fallback values)
- Methodology and tier level declared
- Carbon price paid in country of origin captured (if applicable)
- Data routed to accredited verifier
- Supplier registered or invited to register on the O3CI Portal
- Non-responsive suppliers escalated or flagged for default-value fallback
What comes next
Once you have verified data from your suppliers, it feeds directly into your annual CBAM declaration - due by 30 September 2027 for 2026 imports. The declaration is filed in the CBAM Registry, and the certificate surrender follows. The data-collection process you run this year is the foundation everything else rests on.
The regulation keeps moving - new default values, updated benchmarks, and a proposed scope expansion to downstream products from 2028 are all in the pipeline. Staying current is part of the job.
Can I use my supplier's ESG report or Environmental Product Declaration (EPD) instead of the communication template?
No. ESG reports and EPDs typically rely on industry averages and lifecycle assessment methodologies that do not meet CBAM's requirements. CBAM requires granular, installation-level emissions data calculated using the EU's MRR methodology. Submitting an EPD or LCA in place of MRR-aligned data will not satisfy CBAM requirements and will not allow you to avoid default values.
How often does a supplier need to provide the communication template?
A completed CBAM installation data file is valid for 12 months. Suppliers do not need to provide a new template with every shipment — one per calendar year per installation is sufficient, provided the data covers the relevant reporting period.
What if my supplier's actual emissions are higher than the default value?
You are still better off using verified actual data. Default values carry a mark-up (10% in 2026, rising to 30% from 2028) on top of an already conservative country-level average. A supplier with genuinely high emissions should work on reducing them — but in the meantime, verified actual data at least removes the mark-up penalty.
Does the supplier need to be registered on the O3CI Portal to share data with me?
No — suppliers can still send you the completed Excel communication template directly by email. The O3CI Portal is an optional but increasingly useful route: it allows a supplier to upload data once and share it with multiple EU customers, reducing repetitive work. To use it, you share your EORI number with the supplier so they can grant you access.
What happens if I can't get verified data in time for the September 2027 declaration?
You fall back to default values from IR 2025/2621 for those suppliers. You can still file a compliant declaration using defaults — but you will pay the mark-up, and you cannot retroactively substitute actual data after the declaration is submitted. This is why starting data collection early in 2026 matters.
Related reading
CBAM's Four Forgotten Sectors: Cement, Fertilisers, Hydrogen and Electricity
Steel and aluminium get all the CBAM attention. Here's the practical compliance guide for the four other carbon border adjustment sectors - cement, fertilisers, hydrogen, and electricity - and the traps unique to each.
The CBAM Accredited Verifier: A Practical Guide for EU Importers and Their Suppliers
From 1 January 2026, actual embedded emissions data must be verified by an accredited CBAM verifier. Here's who they are, what they check, what it costs, and why you need to book one now.
The CBAM 50-Tonne De Minimis Exemption: Who's Off the Hook, and the Traps That Catch People Who Assume They Are
The Omnibus I regulation introduced a 50-tonne mass-based de minimis exemption from CBAM. Here's exactly who qualifies, what the all-or-nothing trap means, and why hydrogen and electricity are never exempt.