The COO's Guide to CBAM Phase 2: What Mid-Market Exporters Must Do Before 2027

The EU Carbon Border Adjustment Mechanism started as a concept most operations teams filed under "something legal will handle." It isn't anymore.

CBAM Phase 1 (transitional reporting) ran from October 2023 through December 2025. Phase 2 — full financial liability — begins January 2027. If your company exports iron, steel, aluminum, cement, fertilizers, electricity, or hydrogen into the EU, you are now operating inside a compliance regime that carries real penalty exposure.

This is not a strategy piece. It is a working guide for the COO or Head of Operations who needs to know what CBAM requires, what happens when you miss it, and what "automation-ready" compliance actually looks like.

What CBAM Phase 2 Actually Requires

Under Phase 2, EU importers of CBAM-covered goods must:

1. Purchase CBAM certificates matching the embedded carbon content of each shipment
2. Submit an annual CBAM declaration by May 31 each year for the preceding calendar year
3. Report embedded emissions per the EU's methodology — direct emissions at the production facility, and (for certain sectors) indirect emissions from electricity

The declaration must include:

• Total quantity of each CBAM good imported
• Embedded greenhouse gas emissions per tonne of goods
• Carbon price paid in the country of origin (if any)
• Number of CBAM certificates surrendered

The data burden falls on the EU importer — but the operational burden falls on you, the exporter. Your EU customers will request embedded carbon data. If you cannot provide it in the required format, on schedule, you become a procurement risk they eliminate.

Which Goods Are Covered: CBAM Sectors and HS Codes

CBAM Phase 2 applies to six sectors. If your exports into the EU fall under any of these HS code ranges, you are in scope:

Three things operations teams consistently get wrong on HS classification:

1. Downstream products matter. If you process steel billets into structural components, those components (HS 7308, 7326) may fall within scope even if the billets themselves were covered by your supplier's declaration.

2. Partial shipments create partial obligations. A mixed shipment with CBAM and non-CBAM goods requires line-level classification. One mis-coded line item can trigger an inaccurate declaration.

3. HS codes expand. The EU's CBAM Annex is reviewed periodically. The HS code that was out of scope in 2024 may be in scope as the regulation matures. Classification decisions need a review cadence, not a one-time determination.

If you are not certain whether specific products in your export mix are CBAM-covered, the correct answer is classification by a trade compliance specialist — not an internal assumption.

What a Missed Declaration Costs

The EU has set penalties at €10–€50 per tonne of CO2 not covered by surrendered certificates, with additional penalties for fraudulent or incorrect declarations.

For a mid-market exporter shipping 5,000 tonnes of steel annually into the EU:

These are not hypothetical. The European Commission has been explicit that Phase 2 enforcement will not carry the leniency of the transitional period.

What €50 Per Tonne Looks Like on a Real Balance Sheet

To make this concrete: a mid-market exporter at $100M revenue, exporting primarily to Germany and the Netherlands.

Exporter profile:

• Annual EU steel exports: 8,000 tonnes
• Product mix: structural steel components (HS 7308, 7326)
• Average embedded carbon intensity: 1.8 tCO₂ per tonne of product

CBAM certificate requirement:

• 8,000 tonnes × 1.8 tCO₂ = 14,400 tCO₂ certificates required
• Certificate price estimate (2027): €50–€65 per certificate
• Annual CBAM cost at full compliance: €720,000–€936,000

This is the unavoidable cost of EU market access. It is not a penalty — it is the carbon pricing mechanism working as intended. The penalty exposure is additional:

A company that files a 25% understated declaration pays the certificate cost and the penalty, while creating an audit record that attracts ongoing regulatory scrutiny. The operational argument for automation is not primarily about avoiding the penalty. It is the accuracy and repeatability required to produce declarations that withstand verification — at a volume and frequency that manual processes cannot sustain.

Carbon Price Credit: The Money Most Exporters Leave on the Table

CBAM includes a deduction mechanism that most non-EU exporters have never used: if you paid a carbon price in your country of origin, you can deduct that cost from your CBAM certificate obligation.

The EU maintains a list of recognized carbon pricing mechanisms. As of 2026, full or partial recognition applies to Switzerland (Swiss ETS, fully linked to EU ETS), Norway, Iceland, and Liechtenstein (EEA members). The UK ETS is under review for partial recognition.

For the largest non-EU steel and aluminum exporters — India, Turkey, China, Vietnam, South Korea — no recognized domestic carbon pricing currently applies. South Korea's K-ETS has applied for recognition but has not yet been granted it. India's Carbon Credit Trading Scheme (CCTS) is operational in pilot form but not recognized by the EU Commission.

The practical implication: If you export from India, China, Turkey, or Vietnam, you pay the full CBAM certificate price. There is no deduction. For exporters from Switzerland or Norway, the offset can materially reduce your certificate obligation.

This matters in two ways. First, it directly affects your compliance cost budget for 2027. Second, getting the deduction calculation wrong — claiming a deduction you are not entitled to — creates the same audit exposure as an understated declaration.

If your operations span multiple production geographies, map the carbon pricing status of each jurisdiction before calculating your certificate requirements. Do not assume the deduction applies because you have an internal carbon pricing program or sustainability targets. The EU will not accept those.

The Operational Gap Most Mid-Market Exporters Have Right Now

Here is what we see consistently across the companies we work with:

The data exists. It is not connected.

Production records are in the ERP. Energy consumption data is in facility management systems or manual spreadsheets. Carbon intensity factors for raw materials are on supplier certificates — if they were even requested.

Pulling together embedded carbon per shipment, per product, per production batch is a multi-system, multi-team effort that most operations functions have not yet automated. The output needs to be accurate enough to withstand EU regulatory scrutiny.

The teams most exposed are those where:

• CBAM data assembly is a manual quarterly exercise (or hasn't started)
• The person who "owns" CBAM compliance is also managing 12 other workstreams
• EU customer requests for carbon data are answered with estimates or delayed responses

The 8-Step CBAM Declaration Process

Understanding the full process makes it easier to identify where automation applies — and where manual processes break.

Step 1: HS code classification audit Before the declaration year begins, verify that every product in your EU export mix is correctly classified against the current CBAM Annex. Flag borderline categories for specialist review. This is not a one-time task — review annually as the regulation expands.

Step 2: Embedded carbon data collection Throughout the year, collect production batch data from your ERP and energy consumption records from facility systems. For each batch, calculate embedded direct emissions (Scope 1) using your specific production methodology and the EU's approved calculation approach.

Step 3: Supplier upstream data collection Request embedded carbon certificates from all suppliers whose materials go into CBAM-covered exports. Set a collection deadline of September 30 to allow time for follow-up. For non-responding suppliers, apply EU default carbon values — which are typically higher than actual, meaning more certificates required.

Step 4: Per-shipment emissions matching For each EU shipment during the year, match the specific production batch(es) to the shipment manifest, pull the embedded carbon figure for that batch, and record against the shipment. This is the step that breaks manual processes — it requires real-time data linkage across ERP, production records, and logistics systems.

Step 5: EU customer data requests Your EU customers will request your CBAM data package before they file their own declaration. Most have internal deadlines of February to early March — well before the May 31 EU deadline. Your output format must match their requirements. Some use the EU CBAM Registry format directly; others use internal templates.

Step 6: Declaration assembly Aggregate all shipment-level data into the declaration format: total quantity imported, embedded emissions per good, CBAM certificates to surrender. Cross-check totals against your internal shipment records before delivery.

Step 7: EU CBAM Registry submission The EU importer (your customer) files the declaration by May 31. Your responsibility ends at delivering accurate, verified data by their deadline. If your data is wrong, the importer faces the penalty — and you lose the customer.

Step 8: Documentation retention Archive all source data, calculation methodology, supplier certificates, and final declaration outputs. EU regulations require a minimum 5-year retention period, and audit requests can arrive years after submission.

The steps where manual processes consistently fail: Steps 2–4 (per-batch carbon tracking at scale) and Step 5 (producing customer-specific formats on deadline). Both are integration problems, not data problems. The data exists in your systems.

The Four Operational Gaps to Close Before Year-End

1. Production-to-Shipment Carbon Traceability

You need to know the embedded carbon content of every shipment — not as an annual average, but per batch, traceable to specific production inputs and processes.

Current state at most companies: Annual facility-level carbon data exists, but per-shipment traceability does not.

What's needed: A data pipeline that connects production records → energy inputs → raw material carbon factors → finished goods → shipment manifest. This is not a spreadsheet. It is an automated workflow that pulls data from multiple systems and outputs a CBAM-compliant embedded emissions figure per line item.

2. Supplier Carbon Data Collection

CBAM requires embedded emissions to include upstream inputs. If you buy steel billets and process them, the embedded carbon of those billets needs to come from your supplier — in a CBAM-compliant format.

Current state: Most suppliers in non-EU markets have not yet built this capability. What actually arrives when you send a carbon data request:

• Facility-level annual averages in PDF — the most common response, and the most problematic. CBAM requires per-batch, per-product intensity values. An annual average covering an entire facility does not satisfy this.
• Certificates using non-EU methodology — carbon calculations under ISO 14064 or GHG Protocol Scope 1 do not automatically map to the EU's CBAM calculation methodology. They often need recalculation.
• No response — common for smaller or less CBAM-exposed suppliers who have not prioritized this.

When your supplier cannot provide compliant data, the EU requires you to use default carbon intensity values from Annex IV of the CBAM Implementing Regulation. For the steel sector, the EU default for basic oxygen furnace production is approximately 1.89 tCO₂e per tonne — significantly higher than actual emission-efficient producers in South Korea or India, who may operate at 1.5–1.7 tCO₂e per tonne. The gap is 15–25% more certificates required than if actual data were used.

For an exporter purchasing 5,000 tonnes of steel billets annually as input: the difference between actual supplier data and EU defaults could represent €75,000–€150,000 in additional certificate purchases per year, every year, until your supplier provides compliant data.

What's needed: A systematic supplier data collection process — a structured request with clear format requirements, a tracking system for which suppliers have responded, and a fallback methodology (using EU default values) for those who have not. Start collection by September 2026 at the latest, giving suppliers 90 days to respond before you need to finalize certificate estimates for January 2027.

3. Declaration Assembly and Submission Workflow

The annual CBAM declaration is submitted through the CBAM Registry, which requires an EU-authorized declarant. If you export directly, your EU customers handle submission — but they need your data, in their required format, by their internal deadlines (typically February–March, well before the May 31 EU deadline).

Current state: Most exporters have no formal process for assembling declaration data. When customers request it, operations teams scramble.

What's needed: A repeatable workflow that aggregates shipment data across the year, matches it to embedded carbon figures, formats output to customer specification, and delivers it on a predictable schedule.

4. Audit Trail and Documentation Retention

The EU requires CBAM documentation to be retained for at least five years. This includes production records, supplier certificates, energy consumption data, and the calculation methodology used for each declaration.

Current state: This data exists across multiple systems with no unified retention policy.

What's needed: Document storage with clear retention tagging, indexed by shipment and declaration year.

What "Automated" CBAM Compliance Looks Like

The companies that will handle CBAM at scale without adding headcount are the ones that treat it as an integration problem, not a reporting problem.

The data already exists in their systems. The question is whether it flows automatically from production records into a compliance output — or whether a team member manually assembles it every quarter.

An automated CBAM compliance workflow:

1. Pulls production batch data from the ERP when a shipment is created
2. Looks up embedded carbon factors from a maintained reference table (updated as supplier data comes in)
3. Calculates per-shipment embedded emissions using the approved EU methodology
4. Generates the CBAM data package in the format each EU customer requires
5. Logs every calculation with source data referenced — audit-ready from day one

This is not an off-the-shelf software purchase. It is a workflow built around your specific product mix, your ERP, and your supply chain structure. The methodology needs to match what the EU accepts, and the output format needs to match what your customers request.

Manual vs. Automated: The Operational Reality

The 300–600 hours figure is not an estimate. It is what a workflow audit surfaces when every CBAM-related task is mapped: the data pulls, the supplier follow-ups, the customer formatting requests, the reconciliation before deadline. At $60–80K loaded cost for an experienced operations analyst, that is $28,000–$60,000 in annual labor — for a process that is entirely automatable once the data integrations are in place.

CBAM Readiness Scorecard

Use this to assess your current position. Score each item: 0 = not started, 1 = in progress, 2 = complete.

Total possible: 16 points

Score interpretation:

• 13–16: Compliant-ready. Your systems are in place. Focus on testing the full workflow before January 2027 and validating output with one EU customer before the declaration year begins.

• 9–12: On track with gaps. You have the right intent but specific items need completion before Q3 2026. The batch-level tracking and per-shipment matching gaps are the highest-priority items if they are incomplete.

• 5–8: At risk. Manual processes exist but won't scale to full Phase 2 volume. The window to build automated pipelines closes in Q3 2026. If you score here, the question is not whether to automate — it is how quickly.

• 0–4: Critical exposure. CBAM compliance work has not materially begun. EU customers will begin pressuring suppliers for 2027 data packages in late 2026. If you cannot deliver, you become a procurement risk they will address before the deadline.

Most mid-market exporters who complete this scorecard score between 4 and 8. The gaps are not surprising — the data exists in their systems, but the connections between systems do not. That is what needs to be built before January 2027.

The Three Questions to Answer This Month

If you are a COO or Head of Operations at a mid-market exporter with EU exposure, the most useful thing you can do right now is answer three questions honestly:

1. Do you know your embedded carbon per tonne of exported goods — by product, by batch? Not an annual facility average. Per batch, per product, traceable to production inputs. If the answer is "we have estimates," you have a data traceability gap.

2. Do your EU customers have a formal request process for CBAM data, and do you have a response process? If you are waiting for customers to ask before you figure out the answer, the timeline is already tight.

3. Is CBAM data assembly automated, or is it a person's job? If it is a person's job, that person is a single point of failure for a compliance obligation that recurs every year.

The Preparation Timeline: 7 Months to Phase 2

The question is not whether to prepare. It is whether the preparation timeline is realistic given when you start. Here is how the calendar actually works:

Companies that started in 2024 or early 2025 are already in test-and-validation mode. Companies starting in Q2 2026 have roughly seven months to build — enough time, if work begins immediately. Companies waiting for a customer ultimatum in Q4 2026 face the wrong problem: months to build, weeks to deliver.

The most common scenario we see: a major EU buyer adds a CBAM data clause to supplier contract renewals in October or November 2026. The exporter discovers, at that point, that their carbon data is facility-level annual averages, their supplier certificates are non-compliant PDFs, and they have no shipment-level matching process. Building that infrastructure takes 3–4 months minimum. The customer's deadline is 90 days away.

Positioning well for CBAM Phase 2 is not primarily about compliance. It is about being the supplier that EU buyers can rely on — at a moment when CBAM compliance becomes a differentiator between suppliers that can deliver and suppliers that cannot.

A Trade Operations Assessment covers CBAM readiness as part of the full workflow audit — including a specific review of where your carbon data currently lives, what format your EU customers require, and what a compliant, automated pipeline would look like for your product mix.

If CBAM is your most pressing operational deadline, that is where to start.