CBAM Penalties in 2026: Rates, Calculations, and What EU Importers Must Do Now

CBAM Penalties in 2026: Rates, Calculations, and What EU Importers Must Do Now

CBAM Penalties in 2026: Rates, Calculations, and What EU Importers Must Do Now

Import officer checking shipment data at dock

Under the definitive CBAM regime, authorized declarants face a per tonne of CO2 equivalent (tCO2e) penalty for every certificate not surrendered by the September 30 annual deadline. Importers who bring goods in without authorization face a steeper band: €300–500 per tCO2e, set at the National Competent Authority’s discretion. Critically, paying either fine does not cancel the underlying certificate obligation. You still owe the certificates.

Here is what to do this week:

  • Check your authorization status in the CBAM Registry — operating without authorization triggers the higher Tier 2 band immediately.
  • Confirm your quarterly certificate holdings meet the 50% minimum required at each quarterly checkpoint.
  • Mark September 30 as your hard annual surrender deadline — this is when the definitive declaration is due and the penalty clock starts.
  • Identify any emissions data gaps in your supplier records now, before the Commission’s spot checks cross-reference your customs data against your declared figures.

Enforcement sits with National Competent Authorities (NCAs) in each EU Member State. The Commission coordinates, runs spot checks, and flags irregularities to NCAs — but the penalty notice comes from your NCA, determined by where your authorized declarant is established.

Key Takeaways

CBAM penalties in the definitive regime are financially material: a 300 tCO2e shortfall costs an authorized declarant €30,000 in fines plus the full certificate acquisition cost on top.

Point Details
Tier 1 penalty rate Authorized declarants owe €100/tCO2e for every certificate not surrendered by September 30.
Tier 2 penalty rate Importing without authorization triggers €300–500/tCO2e, set by your NCA within that band.
Penalties are additive Paying a fine does not discharge the certificate surrender obligation — both are owed simultaneously.
September 30 is the hard deadline The annual CBAM declaration and full certificate surrender are due September 30 each year.
CarbonOps for filing CarbonOps maps CN codes, applies default values, and exports Registry-ready declarations with a built-in audit trail.

Table of Contents

The statutory basis for every CBAM penalty is Regulation (EU) 2023/956, which established the Carbon Border Adjustment Mechanism and set out the penalty framework in Article 26. That article gives NCAs the authority to impose financial sanctions on authorized declarants who fail to surrender sufficient certificates, and on any importer who brings covered goods into the EU without authorization.

The regulation draws a sharp line between two phases:

  • Transitional period (October 1, 2023 – December 31, 2025): Reporting obligations only. Importers had to file quarterly reports on embedded emissions but did not yet purchase or surrender certificates. Penalties for missed or incorrect transitional reports applied at lower rates under the original framework — now a historical reference point.
  • Definitive phase (from January 1, 2026): Full financial obligations. Authorized declarants must hold certificates, maintain quarterly minimums, and surrender the full annual amount by September 30 each year.

Regulation (EU) 2025/2083, the Omnibus amendment, reshaped several operational parameters. It harmonized the authorized-declarant shortfall penalty at a fixed rate per tCO2e across all Member States, eliminating the national discretion that had previously allowed different rates in different countries. It also established a penalty band for unauthorized importers and adjusted certain deadlines and procedural rules. The practical effect: your per-tonne exposure is now predictable, which makes it straightforward to model worst-case scenarios from your import volumes.

The goods in scope are those listed in Annex I of Regulation (EU) 2023/956: cement, iron and steel, aluminum, fertilizers, electricity, and hydrogen. If your imports fall under those CN codes, every tonne of embedded emissions in every shipment is a potential penalty unit if certificates fall short.

Statistic: The Omnibus amendment harmonized penalty levels across all Member States, replacing prior national discretion with a single €100/tCO2e rate for authorized declarants — making exposure modeling a straightforward multiplication exercise for the first time.

Who enforces CBAM and who is actually liable

Enforcement is a two-layer structure. The European Commission operates the CBAM Registry, conducts spot checks, and exchanges information with customs authorities across Member States. When the Commission detects an irregularity — a mismatch between customs import data and a CBAM declaration, for example — it notifies the relevant NCA. From that point, the NCA takes over.

The NCA with jurisdiction over your case is the authority in the Member State where your authorized declarant is established. If your declarant is registered in Germany, the German NCA handles your enforcement. If it is in the Netherlands, the Dutch NCA does. This matters because while penalty rates are now harmonized, procedural timelines and administrative practices still vary by Member State.

Who carries the legal liability:

  • Authorized declarant: The primary liable party for certificate shortfalls and declaration accuracy. This is the entity registered in the CBAM Registry and authorized to file on behalf of the importer.
  • Importer (non-authorized): Any business importing Annex I goods without going through an authorized declarant faces the Tier 2 band (€300–500/tCO2e) directly.
  • Indirect customs representative: Where an indirect customs representative acts as the authorized declarant, they assume the declarant’s liability — including penalty exposure. Direct customs representatives do not carry this liability.

The Commission’s guidance for declarants makes clear that the Commission’s role is coordination and detection — not direct penalty imposition. NCAs hold the enforcement pen.

Penalty types and the rates you need to plan for

Two tiers, one clear structure.

Diagram comparing CBAM penalty tiers and rates

Tier 1 — Authorized declarant shortfall (Article 26(1) as amended)

An authorized declarant who fails to surrender enough certificates by September 30 faces €100 per tCO2e of the shortfall. This rate is flat across all Member States following the Omnibus amendment. The penalty is additive: you pay €100/tCO2e and you still must acquire and surrender the missing certificates. The fine does not discharge the obligation.

Tier 2 — Importing without authorization (Article 26(2) as amended)

Any importer bringing Annex I goods into the EU without an authorized declarant faces €300–500 per tCO2e. The NCA sets the exact figure within that band based on the circumstances — severity, duration, evidence of intent. Deliberate evasion of the authorization requirement sits at the top of that range.

Historical transitional penalties (now obsolete)

During the transitional period, penalties for missed or incorrect quarterly reports applied at specified lower rates; these figures are now historical context only. The definitive regime’s rates are three to ten times higher, which is the clearest signal of how seriously the Commission views the financial phase.

  1. Tier 1 (€100/tCO2e): Applies to every tonne not covered by surrendered certificates at the annual deadline.
  2. Tier 2 (€300–500/tCO2e): Applies to every tonne imported without authorization — the NCA determines the exact rate.
  3. Certificate obligation persists: Paying either penalty does not replace the surrender requirement. Both the fine and the certificates are owed.
  4. No cap on total exposure: Penalties are per-tonne and scale directly with import volume and shortfall size.

How authorities compute a CBAM penalty

The arithmetic is straightforward. The formula NCAs apply:

Uncovered tonnes × penalty rate = fine

Add the cost of acquiring the missing certificates to get total financial exposure:

(Uncovered tCO2e × €100) + (Uncovered tCO2e × current certificate price) = total liability

CBAM certificate prices are calculated with reference to EU ETS allowance auction prices and published regularly by the Commission. Certificate prices fluctuate, so your total exposure changes with the carbon market — the penalty component is fixed, but the certificate cost is not.

What counts as “established emissions”:

  • Verified supplier emissions: Where your supplier has provided verified embedded emissions data, that figure is used.
  • Default values: Where supplier-specific data is missing, the Commission’s published default values per CN code and country of origin apply. These defaults are deliberately conservative — they tend to be higher than actual emissions for most suppliers — which means gaps in your supplier data increase your certificate obligation and, by extension, your penalty exposure if you fall short.

Deduction rules for carbon prices paid at origin:

Where a carbon price has been effectively paid in the country of origin for the embedded emissions, a deduction may apply. The Commission’s Q&A documentation notes that an implementing act in 2026 will detail the evidence required for these deductions to be recognized. Until that act is in force, treat deductions as unconfirmed and plan your certificate purchases on the gross figure.

Statistic: Default values for embedded emissions are set conservatively by the Commission — importers relying on them rather than verified supplier data typically face a higher certificate obligation than those with supplier-specific figures.

Pro Tip: Run a monthly reconciliation between your customs import records and your CBAM declared emissions. A gap caught internally costs nothing to fix. The same gap caught by the Commission in a spot check triggers an NCA inquiry.

Common failures that trigger CBAM penalties

Most enforcement actions start with one of five recurring problems.

  • Missing quarterly report: Failing to submit a quarterly CBAM declaration by the deadline is the most visible trigger. The Commission’s cross-check against customs data will surface it quickly.
  • Under-reported embedded emissions: Declaring lower emissions than the goods actually carry — whether from incorrect supplier data, wrong default values, or classification errors — creates a certificate shortfall at surrender time.
  • Failure to maintain the 50% quarterly holding: Authorized declarants must hold certificates equal to at least 50% of the embedded emissions in goods imported since January 1 of that year at each quarterly checkpoint. Falling below this threshold is a compliance failure even if the annual surrender is eventually met.
  • Importing without authorization: Bringing Annex I goods into the EU without an authorized declarant registered in the CBAM Registry triggers Tier 2 immediately, regardless of whether the importer would otherwise have been compliant.
  • Incorrect CN/HS classification: Misclassifying goods to avoid CBAM scope is a serious error. The Commission’s customs data cross-check is specifically designed to catch this.

How NCAs typically respond:

  1. The Commission flags an irregularity and notifies the NCA.
  2. The NCA contacts the declarant with a request to explain or correct.
  3. Where the error is administrative, the NCA may allow a rectification through the Registry or request a delayed submission.
  4. If the declarant does not respond or the error appears deliberate, the NCA issues a formal penalty notice.
  5. Repeat errors or evidence of intentional misrepresentation accelerate the process to formal penalty — and can trigger revocation of the authorization itself.

The Commission’s guidance confirms that spot checks against customs data are the primary detection mechanism. Cross-checking is systematic, not random.

The enforcement process from detection to penalty

Understanding the sequence gives you the windows to act.

  1. Detection: The Commission runs cross-checks between CBAM declarations and customs import data. Mismatches, missing declarations, or unauthorized imports are flagged automatically.
  2. NCA notification: The Commission informs the relevant NCA of the irregularity. The NCA opens a case.
  3. Contact and request to correct: The NCA contacts the authorized declarant, describes the issue, and requests a response or correction within a specified window.
  4. Delayed submission request: Where a declaration was not filed on time, the NCA may request a delayed submission through the Registry. Since October 1, 2024, declarants cannot self-initiate a technical-error delay — the request must route through the NCA. This guidance on delayed submissions narrows the operational safety net considerably going into the definitive phase.
  5. Formal penalty notice: If the declarant fails to respond, correct, or the NCA determines the error warrants a sanction, a formal penalty notice is issued.
  6. Remediation deadline: The declarant has a defined window to pay the penalty and, separately, to acquire and surrender the missing certificates.
  7. Authorization revocation: Persistent non-compliance or deliberate misrepresentation can result in the NCA revoking the declarant’s authorization — effectively barring the importer from bringing Annex I goods into the EU.

Key deadlines to track:

Milestone Deadline / Window
Quarterly declaration submission End of each calendar quarter
50% quarterly certificate holding check Each quarterly checkpoint
Annual CBAM declaration and surrender September 30 each year
NCA-requested delayed submission window 30 days from NCA request (indicative)
Modification period for quarterly declarations Before the annual declaration is finalized

Pro Tip: The modification period for quarterly declarations closes when the annual declaration is finalized. If you spot an error in a quarterly figure, correct it before September 30 — not after.

Appeal and dispute resolution:

Penalty decisions by NCAs are subject to the administrative and judicial review procedures of the relevant Member State. If you receive a penalty notice you believe is incorrect, the first step is a formal written objection to the NCA, supported by your evidence pack (import records, emissions data, certificate purchase history, supplier documentation). If the NCA upholds the penalty, national administrative tribunals or courts handle further appeal. The CBAM regulation does not establish a separate EU-level appeals body for individual penalty decisions.

Practical mitigation steps and a response checklist

Preventive controls (build these now):

  1. Confirm your authorized declarant status is current in the CBAM Registry and that the authorization covers all relevant CN codes.
  2. Build a supplier data collection process — verified emissions data lowers your certificate obligation and reduces the risk of default-value gaps.
  3. Reconcile your customs import records against your CBAM declarations every quarter. Volume, weight, and CN code should match.
  4. Maintain all supporting records for at least four years: import documents, supplier emissions data, certificate purchase records, and filed declarations.
  5. Plan certificate purchases ahead of quarterly checkpoints and the September 30 annual deadline — do not wait until the surrender date to buy.

If you receive an NCA notice:

  • Respond within the NCA’s stated window. Silence is treated as non-cooperation.
  • Request an extension where the NCA’s procedures allow it, and document the request.
  • Correct the declaration through the Registry immediately if the error is factual and correctable.
  • Procure any missing certificates without delay — the certificate obligation runs parallel to the penalty and does not disappear.
  • Assemble an evidence pack: customs declarations, supplier emissions certificates, CBAM filing history, and any correspondence with your NCA.

Pro Tip: Keep your evidence pack current at all times, not just when a notice arrives. An NCA that receives a complete, organized response within days is far more likely to treat an error as administrative rather than deliberate.

Worked example: calculating total exposure for a shortfall

Assume an authorized declarant imports steel with 1,000 tCO2e of embedded emissions in a given year and surrenders certificates for only 700 tCO2e by September 30. The shortfall is 300 tCO2e.

The certificate price used above (€75/tCO2e) is illustrative. Actual prices track EU ETS auction results and are published by the Commission. At higher ETS prices, the certificate cost component grows — total exposure at €90/tCO2e certificates would be €57,000 on the same shortfall.

Where the numbers shift:

  1. Default values: If the declarant used default values instead of verified supplier data, the 1,000 tCO2e figure itself may be overstated. Verified data could reduce the obligation — and the penalty base — if the actual embedded emissions are lower.
  2. Carbon price deductions: If the steel producer paid a carbon price in the country of origin, a deduction may reduce the certificate obligation. Until the 2026 implementing act confirms the evidence requirements, this deduction is not guaranteed.
  3. Tier 2 scenario: If the same importer had no authorized declarant, the penalty rate rises to €300–500/tCO2e. At €400/tCO2e on 300 tCO2e, the penalty alone reaches €120,000 — before certificate costs.

The gap between Tier 1 and Tier 2 exposure on the same physical shortfall is not marginal. Authorization is the single highest-leverage compliance action an importer can take.

What the shift to the definitive regime actually means for your operations

Most commentary on CBAM focuses on the mechanics: rates, deadlines, Registry steps. What gets less attention is the behavioral shift the definitive phase demands from importers and their compliance teams.

The transitional period was, functionally, a learning exercise with modest financial consequences. NCAs were building capacity, the Commission was calibrating its cross-checking systems, and importers could treat a missed quarterly report as an administrative inconvenience. That dynamic is gone. From January 2026, every uncovered tonne carries a €100 fine plus the certificate cost — and NCAs are expected to enforce with the tools and experience they have now spent two years developing.

The administrative safety nets that existed in the transitional phase are narrowing. Declarants can no longer self-request a delayed submission for technical errors; that route now runs through the NCA. Modification windows close at the annual declaration deadline. The Commission’s spot-check infrastructure is operational and cross-referencing customs data systematically.

For senior management, the implication is straightforward: CBAM is now a cash flow item, not just a compliance checkbox. Certificate purchases need to be budgeted and timed. A 1,000 tCO2e import program at current ETS-linked prices represents a real procurement obligation, and a shortfall at surrender adds a penalty on top. Finance teams that have not yet modeled their certificate exposure against import forecasts are running blind into a financially binding deadline.

The importers who will navigate this well are those who treat authorization, data quality, and certificate planning as operational priorities — not annual fire drills.

What the shift to the definitive regime actually means for your operations — overview diagram

CarbonOps turns your import data into a filing-ready CBAM declaration

The mitigation checklist above covers authorization, data collection, reconciliation, and audit trail. CarbonOps is built to handle the filing mechanics of exactly those steps, without a platform deployment or onboarding cycle.

CarbonOps

You enter each shipment with its HS/CN code, mass, and country of origin. CarbonOps maps it to the correct CBAM CN code and sector, applies the Commission’s published default values where supplier emissions data is missing, and exports a completed declaration in the format the EU CBAM Registry expects. Every filing is retained with a full audit trail — the evidence pack your NCA will ask for if a spot check lands on your account. No subscription, no long-term commitment: pay per declaration, single or in multi-packs of 5 or 15. If you have a quarterly filing due, start your declaration at CarbonOps and have it Registry-ready the same day.

Primary sources to consult next

These are the authoritative texts for legal wording, penalty arithmetic, Registry procedures, and certificate pricing. Bookmark them before your next quarterly filing.

  • Regulation (EU) 2023/956: The CBAM legal foundation. Article 26 is the penalty provision. Consult this for statutory wording on declarant obligations and NCA authority.
  • Regulation (EU) 2025/2083 (Omnibus amendment): The harmonized €100/tCO2e and €300–500/tCO2e rates, plus deadline and parameter changes. Read this alongside the base regulation.
  • Commission guidance for declarants: Practical explanation of NCA roles, Commission spot checks, and the rectification/delayed-submission process.
  • CBAM Registry and reporting: Registry functions, declaration submission, and certificate management. The operational hub for definitive-phase compliance.
  • CBAM certificate prices: Current certificate prices linked to EU ETS auction results. Use this to model your total financial exposure alongside the penalty rates.
  • Commission Q&A: Practical answers on deduction rules, evidence requirements, and implementation details — particularly relevant for carbon price deductions at origin.
  • Delayed submission guidance: Step-by-step rules for NCA-requested delayed submissions and the 30-day timing windows.

Sources

CBAM Penalties in 2026: Rates, Calculations, and What EU Importers Must Do Now · CarbonOps