The Carbon Border Adjustment Mechanism (CBAM) is creating demand for consultants, customs specialists, software providers and technical service companies. However, outsourcing compliance work does not transfer the underlying legal responsibility. The authorised CBAM declarant remains responsible for the annual declaration, even when third parties prepare calculations, upload information or support verification. Errors in a verification report can still expose the declarant to penalties.
For importers, this changes how CBAM services should be procured. The objective is not simply to outsource a reporting task, but to establish controls over information received from producers, consultants and verifiers. A declarant that approves data it cannot explain has transferred the work without transferring the risk.
Delegating tasks does not remove legal responsibility
The European Commission states that responsibility for incorrect or insufficient information rests with the authorised declarant, whether that role is held by the importer or an indirect customs representative. Technical submission can be delegated, but the declarant retains responsibility.
Where an error originates with a third party, including a verifier, the national competent authority may consider that circumstance when determining a penalty. It does not automatically release the declarant from liability.
Contracts with service providers can establish professional obligations, allocate financial consequences and provide recourse where errors occur. Nevertheless, contractual protections do not replace the statutory obligation owed to the competent authority.
Build controls around external data and calculations
Effective CBAM governance requires defined ownership of supplier information, version control, named reviewers, documented assumptions and reconciliation against customs entries. Companies also need a clear process for identifying and correcting errors before submission.
The declarant should retain sufficient internal expertise to challenge unusual results and understand how reported emissions were calculated. External consultants and software can support the process, but management must be able to explain the final declaration using the underlying evidence.
The same principle applies to exporters outside the EU. An EU customer’s requests for supporting documents, audit rights and correction commitments reflect its own exposure if supplier information proves inaccurate. Producers in the Western Balkans and other third countries should therefore provide structured evidence that can be traced to the relevant installation and reporting period, rather than relying on a single emissions figure without supporting records.
Separate current law from pending regulatory changes
Policy uncertainty should be managed through scenarios rather than used as a reason to postpone all implementation. Companies can compare the current legal framework with the European Commission’s proposal and the principal differences between Council and Parliament positions, identifying actions that remain useful across possible outcomes.
Product classification, supplier data rights, installation identification and controlled monitoring are examples of areas where preparation can support compliance under different scenarios. By contrast, capital investment whose commercial justification depends on a narrowly defined proposed amendment may warrant waiting for greater legal certainty before commitment.
A controlled source of truth for regulatory status is essential. Each requirement should be identified as current law, an adopted implementing rule, Commission guidance or a pending proposal, with the relevant source date recorded. This prevents a negotiating position or proposed measure from being presented in commercial documents as an existing obligation.
When the legal text changes, the organisation should update its controlled interpretation and associated procedures rather than correcting numerous disconnected spreadsheets and customer presentations.
Liability also affects insurance and financing
The division between statutory responsibility and outsourced work has implications for lenders and insurers. Banks may assess whether a borrower acting as an authorised declarant has adequate compliance controls and contractual recourse against suppliers. Professional indemnity insurance and service warranties may reduce some financial risks, but they cannot eliminate the declarant’s obligation to the competent authority.
Importers should therefore assess service providers not only on price and technical capacity, but also on the quality of their evidence management, review procedures, correction mechanisms and contractual commitments.
For material CBAM exposure, governance should resemble established tax and customs compliance arrangements. This means clear accountability, second-level review, oversight of external providers and appropriate management or board visibility.
Make the submitted number defensible
The practical test is whether the company can explain its declaration to both a verifier and a commercial manager using the same underlying records. The compliance file should connect purchasing, production, customs, supplier data and finance rather than operate as an isolated reporting exercise.
The minimum control file should identify the legal basis, data owner, implementation deadline, key assumptions and the person authorised to approve each decision. It should also document a fallback approach if the preferred calculation or treatment cannot be substantiated. Although that alternative may be commercially less attractive, defining it in advance reduces the risk of discovering the true exposure only after a verifier or competent authority challenges the submission.
For exporters, structured evidence helps EU customers demonstrate the basis of their declarations. For importers, controlled assumptions and documented correction procedures make subsequent adjustments, verification findings and management reporting easier to defend.
CBAM compliance work can be outsourced, but accountability cannot. The authorised declarant needs an evidence trail and internal controls strong enough to support every material figure submitted in its declaration.
