Most of the conversations around the EU’s Carbon Border Adjustment Mechanism (CBAM) have taken place in trade and customs teams. On paper that makes sense, since the legal obligation sits with whoever imports steel, aluminum, cement, fertilizer, hydrogen, or electricity into the European Union.
But the figure that decides what a company pays is set long before goods reach a port. It comes from facilities where those goods were made, and getting hold of those figures depend on supplier relationships that customs teams rarely own. For procurement and sustainability leaders, that turns CBAM into a test of how well their supplier programs work.
A small bill with a long tail
For most large buyers, the financial impact in 2026 will be modest. Importers pay by buying CBAM certificates, each covering one tonne of emissions embedded in their goods and prices in line with the EU’s carbon market. The charge is being phased in over 8 years as free allowances under the EU Emissions Trading System (EU ETS) are withdrawn, and the European Commission expects it to stay minimal until 2030.
What the first year does establish is where companies get their numbers. Importers can declare verified emissions from the facilities that make their goods or fall back on default values, and under Implementing Regulation (EU) 2026/1740 the defaults for steel, aluminum, cement, and hydrogen carry a markup that climbs from 10% in 2026 to 20% in 2027, and 30% from 2028 onwards. When an importer can’t establish where a supplier’s input materials came from, the default is set to match the most emissions-intensive country in the tables.
The Partnership for Carbon Transparency (PACT) has put a rough number on the difference, estimating that, for a steel example, relying on defaults could cost 20% to 80% more in certificates than using verified supplier data.
The numbers live inside supplier facilities
CBAM is calculated at the facility level, with each production site measuring the emissions tied to the goods it makes, and having them checked by an accredited verifier. Only verified figures can replace default values in an importer’s CBAM declaration.
Many importers first turned to the product carbon footprints (PCFs) they already held, expecting them to do most of the heavy lifting. However, PACT’s analysis found they only go part of the way. CBAM needs data that product-level accounting rarely keeps, such as the total emissions of a whole site before they’re split across products, emissions broken down by gas, and heat and electricity tracked separately.
Even good data needs checking, and verification capability is still thin. The first verifiers only received accreditation in late September 2026, with EmiCert and Bureau Veritas both announcing theirs, and at that point just five EU accreditation bodies were accepting applications from verifiers based outside the EU. The first verification reports can’t be issued until January 2027, so suppliers that haven’t lined up a verifier may struggle to provider verified figures for this year’s imports.
That shifts much of the work towards procurement. The EU’s CBAM registry lets suppliers share facility data once with all their EU customers, but only after each buyer has asked for it and passed on the identification number the system needs. Someone must make the request, and it usually falls to whoever owns the supplier relationship.
A reach that extends well beyond Europe
Although CBAM is EU law, its effects travel through global supply chains. The UK will introduce its own CBAM on January 1, 2027, and the European Commission reports that Australia, Brazil, Canada, and Taiwan are considering similar measures. While the EU mechanism is being extended to Norway and Iceland through the European Economic Area (EEA) agreement. Suppliers outside Europe can now expect the same facility data to be requested by more than one market.
Suppliers that already pay a carbon price at home have an added reason to engage, because that price can reduce their customer’s CBAM bill. It only counts if it was actually paid and can be documented, and the European Commission has not finalized the detailed rules for this reduction as of late September 2026.
The UK has moved faster, publishing a list of overseas carbon pricing schemes that qualify for relief under its own CBAM, including those in Canada, China, India, Japan, and South Korea. No US Scheme is on it at this time.
The list of covered goods is also set to grow. The European Commission has proposed extending CBAM to 180 steel and aluminum-intensive products from 2028. EU member states have backed a list of around 200 with an annual review of further products, and in September the European Parliament voted for more than 450, including heat pumps, solar panels, and household appliances.
Downstream goods come with longer and more global supply chains, which the European Commission acknowledges will make actual emissions data harder to obtain. Retailers have raised the same concern, with EuroCommerce warning that importers who don’t manufacture the goods they sell may have no access to material composition or the origin of embedded materials.
Where procurement and sustainability meet
In most companies, the parts of CBAM sit with different teams. The legal obligation lands with whoever manages imports, the emissions expertise sits with sustainability, and the supplier relationships that hold the data sit with procurement. Few Scope 3 programs are set up to bridge that gap yet: in the Scope 3 Peer Group’s 2025 tools review, only 7% of 175 practitioners said they mainly use supplier-specific data, while 42% still relied on spend-based or industry-average figures. CBAM specifically rewards the suppliers-specific, facility-level data that most programs just don’t collect yet.
The transitional period suggested that the problem is solvable when buyers engage suppliers directly. Between late-2023 and mid-2025, the share of imports reported with actual emissions rose from 8% to 53%, and the European Commission attributes the shift to importers working with their supply chains to obtain primary data.
The companies that benefit most are likely to treat CBAM as one use of supplier data among many. PACT advocates for collecting underlying data once, in enough detail to serve each reporting requirement from the same base, and the SBTi Corporate Net-Zero Standard V2.0 points in a similar direction by asking companies to prioritize suppliers of emission-intensive materials such as steel, cement, and aluminum.
What sits behind the numbers
But behind every embedded emissions figure is a production process. In some CBAM sectors, much of the footprint comes from the chemistry itself, such as limestone calcification in cement or the chemical processes behind aluminum, fertilizers, and hydrogen. Heat plays a larger role in steel and across the wider manufacturing base buyers depend on. IRENA estimates that fossil fuels supplied 89% of industrial heat in 2020, and across Secaro’s own supplier data, natural gas is the largest single source of facility-level direct emissions in every sector we track.
That makes heat one lever on CBAM exposure as well as for climate targets, since lower embedded emissions mean fewer certificates, and a smaller cost passed down the supply chain.
Supplier decarbonization programs are increasingly moving beyond disclosure toward this kind of operational change. Initiatives like the Clean Heat Program, developed by Secaro with ERM, support suppliers in understanding how heat is used across their facilities and in building investment-ready plans to change it.
Starting before the bill grows
CBAM’s financial weight will build steadily through to 2034, and the product list looks set to keep expanding through the annual reviews EU member states have backed. Procurement and sustainability leaders can use this early period to find out which suppliers behind their highest-volume CBAM goods can already provide verified, facility-level data, and to start conversations with those that can’t, while the cost of not having it is still low.
