CBAM Supplier Data: Build a Request and Verification Workflow

An emissions number is not yet a usable record

A steel trader receives three files: a product footprint, a spreadsheet of carbon figures and a friendly assurance that everything is CBAM compliant. Yet nobody can establish which installation produced the goods or which year the numbers describe. A reliable supplier-data workflow starts at precisely this point. Its output is not a spreadsheet with every cell filled, but a traceable decision about which information can be used for which transaction, what remains missing and who must resolve the discrepancy. This guide concerns German businesses importing steel into the EU and the organisations supplying their data.

The broader procurement, customs and sustainability task matrix establishes ownership. This article focuses more narrowly on the deliverables: a clear request, a reviewable dataset and a discrepancy log. The suggested status labels, response deadlines and approval fields are internal process choices, not statutory forms. An internal plausibility check replaces neither assessment of the import’s legal position nor any required accredited verification. Put that distinction on the first page of the working instruction so that a green workflow status cannot accidentally be interpreted as an official assurance.

Establish the scope and data route first

The definitive CBAM regime has applied since 1 January 2026. The Commission’s current definitive-regime overview explains the framework; the goods code, import arrangement and applicable exemptions still require assessment for the actual transaction. Do not carry transitional-period spreadsheets forward without checking them. Open the request with a named purpose and a designated technical reviewer. Procurement can coordinate the response, but should neither infer CBAM applicability from a product description alone nor automatically approve a code suggested by the supplier.

Also establish whether the intended route uses actual emissions or applicable default values, and who is competent to decide. The Commission’s verification information explicitly distinguishes these routes. Where actual emissions are used, independent verification by appropriately accredited verifiers is separate from your incoming-data review. In October 2026, in-year figures are also not equivalent to a completed, verified annual report. Request the current working status and the planned completion date instead of signing off a provisional figure as final evidence.

Structure the supplier request into six clear parts

Start with a reusable covering request: “We need CBAM information for the goods and production installations identified below. Please confirm the responsible installation operator, reporting period and methodology used. Explicitly label provisional, missing or inconsistent information. Our internal response deadline is the agreed date; if you cannot meet it, identify the missing information, a responsible contact and a realistic follow-up date.” Add the case reference and secure submission route. This asks for reviewable answers to a defined need, not a blanket guarantee of compliance.

Part one links your item reference and goods description to the technically reviewed CN code. Part two separates the contracting supplier, intermediary and actual installation operator: names, location, country and any available unique installation identifier should not be collapsed into one free-text field. Part three identifies the production year or relevant reporting period, the goods covered and their relationship to your deliveries. Ask for an explanation where a delivery comes from several installations. A company logo or group headquarters address does not establish that the named installation produced the particular goods.

Part four requests values together with units, calculation basis and status. Distinguish tonnes of goods, tonnes of carbon-dioxide equivalent and specific emissions per tonne of goods. Part five records the associated emissions and verification reports or their planned availability. Part six captures the version, responsible contact, unresolved questions and changes from the previous response. The current EU quick guide for non-EU installation operators explains communication through the registry or through operators’ own tools and use of the emissions-report template. Your request supports those technical documents; it does not replace them.

AI-generated

Review incoming data without silently repairing figures

The first review is administrative: is the response complete, readable and linked to the correct request? Do the version and sender match? Are empty fields explained as not applicable, pending or unavailable? Next comes substantive mapping: do the installation, goods and period belong together? Preserve the original file and record your assessment separately. Someone who independently changes a decimal separator, unit or installation name otherwise creates a new dataset whose author and technical basis may become impossible to reconstruct when another colleague takes over.

A product carbon footprint is not automatically a CBAM calculation. The EU iron-and-steel guidance describes sector-specific boundaries, production routes and precursors. Establish which goods and processes a figure actually covers. For iron and steel goods covered by Annex II, indirect electricity emissions are not simply added as they were reported during the transitional period; the guidance also addresses exceptions and relevant precursors. Have the actual classification technically confirmed. A buyer should neither derive a CBAM figure from a sustainability report nor approve a number merely because the arithmetic looks plausible.

Use arithmetic checks only as warning signals. Suppose a training file states 100 tonnes of goods and 1.8 tonnes of carbon-dioxide equivalent per tonne. Simple multiplication gives 180 tonnes of carbon-dioxide equivalent. If another field states 18, the discrepancy needs clarification. That calculation confirms neither the boundaries nor the origin or verification of the data. Record an arithmetic mismatch between the named fields and ask a specific question. This makes the query reproducible without quietly returning your own interpretation as the supplier’s corrected result.

Three discrepancy cases with a clear next decision

Case one: the trader replies for Installation A, while delivery records refer to Installation B. Mark the dataset as mapping unresolved, rather than labelling the entire supplier unsuitable. Request a traceable connection between the goods, actual production installation and dataset. The technical owner decides whether a replacement response or further evidence is needed. Data approval remains open; the responsible people separately decide how to handle the delivery operationally. An unresolved spreadsheet row is neither automatic import permission nor a statutory import prohibition invented by your workflow.

Case two: an impressive PDF contains only a group-wide figure for 2025. Ask for the reporting period and installation relationship appropriate to the intended use; do not copy the figure merely because no alternative has arrived. Case three: a familiar contact suddenly provides a new upload link and demands immediate sign-in. Verify the channel through established contact details. This is a practical application of social-engineering training: genuine urgency must not override recipient and access checks. Otherwise, a technically sound request can itself become a route for disclosing sensitive information.

Initially, six well-maintained fields are enough for each discrepancy: affected dataset, observed inconsistency, question sent, responsible person, next review date and closure evidence. Separate response received from technically resolved. If a deadline passes, escalate the specific missing point and affected transactions, not just a red indicator. Assess permissible next steps against current CBAM legislation and guidance. A documented applicable default value is different from a home-made estimate; the choice belongs to the responsible technical function.

AI-generated

Share sensitive information selectively

The CBAM Registry provides the O3CI route for non-EU installation operators. The Commission explains how installation and emissions data can be shared with declarants. Confirm the actual permission and recipient first; registration alone does not establish that the correct dataset is available. Where files are exchanged instead, use an approved channel, restricted access and traceable versions. Information-sharing exercises from the TISAX context provide a useful training method here, without implying that CBAM suppliers are therefore required to obtain a TISAX assessment.

The request should ask only for information needed for the defined purpose. A package containing private contact details or unnecessary identity-document copies does not automatically belong in a shared procurement folder; role-based data-protection training helps teams recognise that boundary. Equally, CBAM does not justify open exchanges of future prices or sales strategies among competitors. Competition-law boundaries in steel sales remain relevant when several businesses discuss a technical data question together. Review sensitive additional requests rather than adding them to every standard enquiry just in case.

Approve a defined data snapshot. The review note identifies the file version, supporting attachments and specific intended use, as well as anything not yet confirmed. If a corrected supplier response arrives later, retain the old version and label it superseded. Assess which prepared analyses or handovers are affected. Replacing a file in a folder does not reliably notify the downstream recipient. Obtain acknowledgement of the correction and link the new review note to the original case. This simple change control prevents procurement using version three while the technical reviewer is still assessing version two. For repeat deliveries, existing installation mapping can provide a starting point, but confirm whether production, goods mapping or the data basis changed before carrying forward an old approval status.

Practise the workflow and evidence completion

Test the workflow with a real, anonymised data package containing three introduced faults: the wrong installation, a missing unit and a provisional report. Procurement drafts the query, the technical reviewer explains the status and a deputy tries to take over using the stored record alone. The learning objective is met when all three faults are identified and no unresolved item appears approved. As with ISO 27001 awareness, the aim is reliable decisions within each person’s role, not turning employees into auditors or emissions verifiers through a short exercise.

Keep separate records of what the supplier provided, what your reviewers assessed and what the training demonstrated. Traceable training records identify the roles, case version, outcome and further learning needed; they do not prove that a later CBAM declaration is correct. After the pilot, check whether questions have become more precise, unresolved cases have owners and deputies can locate the last approved version. A falling number of open cases is meaningful only where genuine closure evidence exists.

Start with one supplier and a clearly defined goods group. Agree the six request sections, test a complete response and follow the first discrepancy through to documented resolution. Only then extend the workflow to other suppliers. ConformBase’s steel package lists CBAM topics for importers and suppliers; according to the offer reviewed on 26 October 2026, booking follows the final content review. Digital learning can support this working method, but it replaces neither emissions calculations nor accredited verification or technical assessment of an individual case.