The Carbon Border Adjustment Mechanism (CBAM) is driving demand for consultants, customs specialists, software providers and technical service companies. Companies are increasingly considering outsourcing parts of compliance work. The underlying legal responsibility, however, remains with the authorised CBAM declarant.
Even when third parties prepare calculations, upload information or support verification, the authorised declarant is responsible for the annual declaration. Errors in a verification report can still lead to penalties for the declarant. This affects how importers approach procurement of CBAM services.
Delegating technical tasks does not shift legal responsibility
The European Commission states that responsibility for incorrect or insufficient information rests with the authorised declarant. This applies whether the role is held by the importer or by an indirect customs representative. Technical submission may be delegated, but responsibility does not follow the outsourced work.
Where an error originates with a third party, including a verifier, the national competent authority may take that into account when determining a penalty. It does not automatically remove liability from the authorised declarant. Contracting arrangements can define professional obligations and recourse, but statutory obligations to the competent authority remain.
Controls over supplier data and verification inputs
Effective CBAM governance requires defined ownership of supplier information and version control for data used in reporting. Companies are also expected to use named reviewers, document key assumptions and reconcile reported emissions against customs entries. A process is needed to identify and correct errors before submission.
The declarant should maintain internal expertise to challenge unusual results and understand how reported emissions were calculated. External consultants and software can support calculations and preparation, but management must be able to explain the final declaration using underlying evidence. Approving information that cannot be explained is described as transferring work without transferring risk.
Evidence expectations for non-EU exporters
The same approach applies to exporters outside the EU when their information feeds into EU declarations. EU customers may request supporting documents, audit rights and correction commitments as part of their own exposure management. If supplier information proves inaccurate, those requests reflect downstream responsibility.
Producers in the Western Balkans and other third countries are therefore expected to provide structured evidence linked to the relevant installation and reporting period. The expectation is that evidence can be traced to the installation rather than relying on a single emissions figure without supporting records.
Managing regulatory uncertainty and maintaining a source of truth
Policy uncertainty should be handled through scenarios instead of delaying implementation entirely. Companies can compare the current legal framework with the European Commission’s proposal and identify principal differences between Council and Parliament positions. This helps determine which actions remain useful across possible outcomes.
Preparation areas include product classification, supplier data rights, installation identification and controlled monitoring. Capital investment tied to a narrowly defined proposed amendment may require waiting for greater legal certainty before commitment. A controlled source of truth for regulatory status is described as essential.
Each requirement should be identified as current law, an adopted implementing rule, Commission guidance or a pending proposal, with a recorded source date. This is intended to prevent commercial documents from presenting a negotiating position or proposed measure as an existing obligation. When legal text changes, organisations should update controlled interpretations and procedures rather than correcting disconnected spreadsheets.
Implications for financing, insurance and provider selection
The division between statutory responsibility and outsourced work has implications for lenders and insurers. Banks may assess whether a borrower acting as an authorised declarant has adequate compliance controls and contractual recourse against suppliers. Professional indemnity insurance and service warranties may reduce some financial risks but cannot eliminate the declarant’s obligation to the competent authority.
Importers are advised to assess service providers beyond price and technical capacity. Provider evaluation should also cover evidence management quality, review procedures, correction mechanisms and contractual commitments. For material CBAM exposure, governance should resemble established tax and customs compliance arrangements.
This includes clear accountability, second-level review, oversight of external providers and appropriate management or board visibility. The practical objective is that submitted figures can be defended using internal records that support both verification processes and commercial decision-making.
Defensible declarations through documented control files
The practical test described is whether a company can explain its declaration to both a verifier and a commercial manager using the same underlying records. The compliance file should connect purchasing, production, customs documentation, supplier data and finance rather than operate as an isolated reporting exercise.
A minimum control file should identify the legal basis, data owner, implementation deadline, key assumptions and the person authorised to approve each decision. It should also document a fallback approach if preferred calculations or treatments cannot be substantiated. Defining alternatives in advance is described as reducing risk if challenges arise after submission.
For exporters, structured evidence supports EU customers in demonstrating the basis of their declarations. For importers, controlled assumptions and documented correction procedures are intended to make subsequent adjustments, verification findings and management reporting easier to defend. Outsourcing can be used for CBAM compliance work, but accountability remains with the authorised declarant.