The supplier-data dependency problem in 2026 CBAM filings

Here's the issue: when the Carbon Border Adjustment Mechanism transitional period ends on December 31, 2025, non-EU exporters and EU importers face a new cost structure. Actual-value declarations become mandatory. Installation-level emissions data from suppliers becomes the only accepted input. The default penalty for missing data is now 2-5x the real footprint, priced in euros per tonne of embedded carbon. Most companies have budgeted for the reporting work—few have budgeted for the supplier data collection bottleneck that determines the final certificate cost.

However, a CBAM filing consists of two things: the embedded emissions calculation and the supplier data that feeds it.

The embedded emissions calculation on its own has no value. Supplier data is what the EU Commission verifier is actually asking for, what the CBAM declarant is actually paying for, and what the January 2026 certificate purchase is tied to. Without installation-level primary data from the non-EU producer, the importer must use the sectoral default value—which for steel averages 2.1 tonnes CO2e per tonne of product, versus a typical installation value of 0.9-1.4 tonnes. For cement, the default is 766 kg CO2e per tonne versus installation averages of 520-680 kg.

While the cost of emissions calculation software has become cheaper, the cost of supplier data collection has become more expensive. If an importer covers 100 tonnes of steel per quarter and the supplier provides no installation data, the importer purchases certificates against the 2.1-tonne default: 210 tonnes CO2e. At a certificate price of €80 per tonne (the approximate ETS price in Q4 2025), that's €16,800. If the supplier had provided verified installation data showing 1.2 tonnes CO2e per tonne of steel, the liability drops to €9,600—a €7,200 difference per 100-tonne shipment, recurring every quarter.

How do you solve this? I think the 2026 shift forces importers and exporters to choose between two supplier data strategies: accept the default-value penalty and absorb the cost, or build a supplier data collection workflow that delivers installation-level evidence before the quarterly filing deadline. For now, the operators we work with are treating supplier engagement as procurement infrastructure, not sustainability admin—because the certificate cost difference shows up in the P&L, not the CSR report.

The shape of the argument, visualised below.

The 2026 CBAM supplier data requirement

From January 1, 2026, the CBAM definitional regime takes effect. EU importers of steel, cement, aluminium, fertilizers, electricity, and hydrogen must purchase CBAM certificates corresponding to the embedded emissions of imported goods. The certificate price tracks the EU ETS allowance price. The embedded emissions value is calculated using either actual installation data from the non-EU producer or a conservative sectoral default published by the European Commission.

The GHG Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard underpins the calculation methodology, but CBAM adds a verification layer. As IntegrityNext notes, "CBAM creates a clear dependency: importers can report accurately only if non-EU producers provide verified emissions data. Where supplier data is missing, companies may need to use conservative assumptions—potentially increasing cost exposure and compliance risk."^[1]

This is not a reporting technicality. It is a procurement dependency. The importer's certificate liability is determined entirely by whether the supplier provides installation-level data.

Actual-value versus default-value comparison

The default value is not a placeholder. It is a penalty designed to incentivise supplier data provision. The European Commission set default values at the 90th percentile of sectoral emissions distributions specifically to make non-disclosure expensive.

Why supplier data collection is now a procurement function

Most importers treat CBAM as a compliance exercise: file the quarterly report, purchase the certificates, move on. But the certificate cost is not fixed. It is a function of the supplier's willingness and ability to provide verified installation data.

This shifts supplier data collection from sustainability teams to procurement teams. The cost differential is too large to treat as a reporting footnote. For a mid-sized steel importer bringing in 1,000 tonnes per quarter, the default-value penalty is €56,000–€96,000 per quarter, or €224,000–€384,000 annually. That is a procurement negotiation, not a sustainability KPI.

As Simple notes in their EU ETS and CBAM guidance, "ETS: annual MRV and allowance surrender. CBAM: embedded-emissions certificates required from January 2026."^[2] The MRV (monitoring, reporting, verification) system that EU ETS operators already use is the same system non-EU suppliers must now build to provide installation data. Exporters without MRV infrastructure cannot provide actual-value data. Importers without supplier engagement workflows cannot collect it.

The timeline is compressed. The first quarterly filing under the definitional regime is due by April 30, 2026, covering January–March 2026 imports. Suppliers who have not yet built MRV systems will miss the Q1 deadline. Importers who wait until February to request data will absorb the default-value penalty for at least one quarter.

The verification bottleneck

Supplier data provision is necessary but not sufficient. CBAM requires third-party verification of installation-level emissions data. The verifier must audit the supplier's fuel records, electricity invoices, process emissions calculations, and production volumes. This is the same verification methodology used for EU ETS compliance, adapted for non-EU installations.

The bottleneck is verifier capacity. As of December 2025, fewer than 150 accredited verifiers operate outside the EU with the sectoral expertise required for steel, cement, and aluminium installations. Most are concentrated in Turkey, the UK, and Ukraine—markets with existing carbon pricing mechanisms. Suppliers in markets without domestic carbon pricing (India, Vietnam, Indonesia) face longer verification timelines and higher audit costs.

For a typical steel installation producing 50,000 tonnes annually, the first-year verification cost ranges from €12,000 to €25,000, depending on the complexity of the MRV system and the verifier's travel requirements. Subsequent annual verifications cost €8,000–€15,000. These costs are borne by the supplier, not the importer—but the importer absorbs the default-value penalty if the supplier declines to verify.

This creates a negotiation asymmetry. The supplier incurs the verification cost. The importer incurs the default-value penalty. Unless the importer can pass the penalty downstream to the end customer, the importer must either absorb the cost or negotiate a supplier data SLA that includes verification.

Scoring the two strategies

We evaluate the actual-value and default-value strategies against five criteria:

1. Upfront cost: Initial investment in supplier engagement, MRV setup, and verification coordination.
2. Recurring certificate cost: Quarterly CBAM certificate purchases over a 12-month period.
3. Supplier relationship risk: Likelihood of supplier pushback, contract renegotiation, or supply chain disruption.
4. Audit readiness: Ability to defend the filing methodology under EU Commission audit or third-party assurance.
5. Scalability to 2027: Readiness for the expected CBAM expansion to downstream products (screws, wire, rebar) under active Commission consultation.

The actual-value strategy has a higher upfront cost but a structurally lower recurring cost. The default-value strategy avoids supplier friction but locks in a recurring penalty that grows as import volumes and certificate prices rise.

The 2027 scope expansion

The European Commission has signaled interest in extending CBAM to downstream products: screws, wire, rebar, and other steel-derivative goods. Public consultations on this expansion are active as of Q4 2025. If the expansion proceeds, the default-value penalty will compound.

A steel importer currently purchasing 1,000 tonnes of raw steel per quarter may also import 200 tonnes of rebar and 150 tonnes of wire. Under the current CBAM scope, only the raw steel is covered. Under the expanded scope, the rebar and wire would also require CBAM certificates. If the supplier provides no installation data, the importer absorbs the default-value penalty across all three product categories.

The cost differential scales linearly with scope. For an importer covering steel, rebar, and wire, the default-value penalty could reach €100,000–€150,000 annually by 2027. Exporters who build MRV systems now will be ready for the expansion. Exporters who defer will face a compressed timeline and higher verification costs when the expanded scope takes effect.

How Emission3 fits

Emission3 is positioned as productized CBAM implementation backed by compliance infrastructure. We handle the supplier engagement workflow, MRV scoping, verifier coordination, and quarterly filing generation. The platform ingests supplier utility bills, fuel invoices, and production records—then calculates installation-level embedded emissions following GHG Protocol and EU ETS methodologies.

Every number is reproducible. The filing includes full lineage from source document to line-item emission. The verifier receives an evidence pack with utility bills, calculation sheets, and methodology documentation. The CBAM declarant receives a submission-ready report with certificate quantities and tariff codes.

We work with non-EU exporters (steel, cement, aluminium producers) who need actual-value declarations to avoid the default penalty, and with EU importers who need supplier data collection workflows to reduce certificate costs. The workflow starts with a CBAM readiness call: we map suppliers, identify MRV gaps, and scope the verification timeline.

For a steel exporter producing 50,000 tonnes annually across two installations, the implementation timeline is 8–12 weeks from kickoff to first verified filing. The platform handles monthly data ingestion, quarterly report generation, and verifier coordination. The exporter provides raw documents; we deliver the verified installation-level emission factor the importer needs for the CBAM filing.

Start with a CBAM readiness call

The 2026 CBAM shift is not a reporting exercise. It is a procurement dependency with a recurring cost penalty for missing supplier data. Importers who wait until Q1 2026 to engage suppliers will absorb the default-value penalty for at least one quarter. Exporters who defer MRV setup will lose competitive position as importers prioritize suppliers who can provide actual-value data.

If you are a non-EU exporter or an EU importer covering steel, cement, aluminium, fertilizers, or electricity, book a CBAM readiness call. We map suppliers, identify MRV gaps, scope verification timelines, and deliver a timeline to first verified filing. No anonymous self-serve onboarding—every customer starts with a readiness conversation.^[3]

The default-value penalty is not a compliance risk. It is a P&L line item. Treat it accordingly.