CBAM exporter–importer data flow: who reports and who provides data

The supplier is not necessarily the producer

A purchase invoice may name a trader, distributor, exporter, or group sales company while the production records sit with a different operator and installation. That distinction is the starting point for a usable CBAM handoff: commercial supplier identity helps route the request, but producing-installation identity owns the monitoring and emissions evidence.

On the EU side, the importer and the authorised CBAM declarant path connect the imported goods record to the annual CBAM declaration. On the production side, the operator of the non-EU installation determines and maintains the installation, process, goods, period, and emissions records. Intermediaries preserve the reference chain and forward clear requests; they do not become the producer merely because they issued the invoice.

The reader job is therefore not to ask every supplier for the same generic carbon number. It is to identify where the production data originates, pass a stable goods/request reference upstream, receive a versioned operator or disclosure reference and organised evidence back, and keep missing links visible until the EU-side reviewer can reconcile them.

This page owns that actor and data-lineage map. The supplier-request guide owns the exact field list and follow-up cadence; the authorised-declarant guide owns authorised CBAM declarant status; the supplier-emissions and verification guides own embedded-emissions data and accredited-review detail.

Current legal roles and the disclosure path

Article 4 of the consolidated Regulation (EU) 2023/956 places importation in the authorised CBAM declarant framework, and Article 6 places the annual CBAM declaration in that authorised CBAM declarant workflow. This actor map assumes the relevant import is within the obligation path; it does not decide the separate Article 2a mass-threshold exemption. The commercial supplier, exporter, or non-EU operator is not substituted for the EU-side role by this data handoff.

Where actual emissions are used, Article 8 requires the authorised CBAM declarant to ensure that the declared embedded emissions are verified by an accredited verifier. Article 8(2) allows the declarant to use verified information disclosed under Article 10(7) for goods produced in a registered third-country installation. A supplier spreadsheet or O3CI registration alone does not satisfy that verification boundary.

Article 10 allows an operator of a third-country installation to request registration of the operator and installation in the CBAM Registry. It places installation-level calculation, verification, record-retention, and disclosure actions with the operator, and allows the operator to disclose relevant verified information to an authorised CBAM declarant. Registration does not transfer the declarant's EU obligations to the operator.

Implementing Regulation (EU) 2025/2550 and the current Registry framework govern access and data processing in the Registry. Where operator authorisation is required for declarant access to registered personal data, preserve that authorisation boundary rather than assuming every party in a commercial chain can see every field.

Actor and responsibility matrix

Use this matrix to assign the owner of each factual record and handoff action. It is a preparation map, not a legal determination of particular contracts or customs arrangements.

One organisation can hold more than one commercial or regulated role, but the underlying responsibilities and evidence origins should still be labelled separately.

Four commercial-chain request paths

The request should follow the commercial chain until it reaches the operator that controls the production records. The return path should preserve the same goods, purchase, supplier, operator, installation, period, and evidence references in the opposite direction.

Commission Guidance 1 explicitly recognises that intermediary traders may need to forward a declarant request to the operator of the installation that produced the goods. Treat that as current explanatory guidance, not as a new legal duty invented by CBAM Pulse.

Minimum cross-party reference chain

A reference chain lets each party return the correct source record without exposing unrelated commercial data. It should be stable enough to survive forwarding, translation, personnel changes, and later evidence updates.

These are product-designed preparation fields, not a new official form. Use the Commission Communication Template and operator emissions-report structure where applicable, and keep local references mapped rather than replacing the official source identity.

O3CI and direct communication are two different paths

The Commission's current CBAM Registry page describes O3CI as the module for non-EU installation operators. It allows registered operators to upload and share installation and emissions data with reporting declarants, supports confidential treatment of business-sensitive data, and lets declarants retrieve disclosed installation/emissions information. The page also describes sharing the declarant EORI with the supplier outside the Registry for that workflow.

Commission Guidance 2 describes O3CI registration as the recommended but currently voluntary method. An operator that does not register can arrange direct communication with concerned declarants and other operators, using the same operator emissions-report template. Do not present the recommended path as mandatory.

O3CI and direct exchange solve a communication problem; neither changes the underlying data-quality, verification, goods-mapping, or declarant-review requirements. CBAM Pulse does not connect to, upload to, or retrieve from O3CI or the CBAM Registry.

Synthetic intermediary handoff

This synthetic example uses invented actor names and references and contains no emissions values. It illustrates a traceability problem only; it does not identify a real supply chain or decide which data may be used in a declaration.

Importer Delta buys covered goods from Trader Alpha. Alpha sourced them through Exporter Beta, while Operator Gamma controls the producing installation and operator emissions report. Delta's request reference must travel through Alpha and Beta to Gamma; Gamma's installation, goods/process, period, disclosure/report, and verification references must return through the authorised channel to Delta's declarant record.

If Beta returns only its corporate footprint or Alpha cannot identify Gamma, the chain remains unresolved. The importer does not replace Gamma with the invoice issuer, and the commercial intermediaries do not inherit the operator's monitoring or verification role.

Confidentiality without losing traceability

A general supplier email should not demand unrelated recipes, customer lists, pricing, or other commercial secrets. Request the minimum installation, goods/process, period, method, evidence-state, and reference information needed for the CBAM handoff, then use a controlled disclosure route for supporting material.

O3CI can support confidential treatment of business-sensitive data and summary disclosure as described by the Commission. Implementing Regulation (EU) 2025/2550 also preserves operator authorisation boundaries for declarant access to relevant registered personal data. Those controls do not make CBAM Pulse responsible for confidentiality, and they do not make every document visible to every chain participant.

Article 14(4) of the consolidated Regulation (EU) 2023/956 provides a separate Registry boundary: Registry information is confidential subject to specified public-field exceptions for operator, installation, and verifier information, and an operator may choose not to make the listed operator and installation details accessible to the public. That public-field rule is distinct from an operator's authorised disclosure to a declarant.

Where direct communication is used, record the channel, recipient, version, and access limitation without copying sensitive attachments into an ungoverned tracker. The workflow described here uses references and preparation states; CBAM Pulse does not store supplier evidence files or operate a secure document exchange.

Unresolved data and follow-up

Treat each missing link as a named state, not a reason to invent a value. The request owner should know which party was contacted, which upstream operator is still unknown, which reference was forwarded, and when the next review occurs.

The supplier-request guide owns the field list and follow-up cadence. This page keeps the actor/path problem visible so the same unanswered production question is not repeatedly sent to a trader that cannot generate installation evidence.

• Producer unknown: ask the intermediary for the producing operator and installation reference.
• Installation unknown: keep the goods line blocked; do not use the trader's office or invoice address.
• Goods/process/period mismatch: return the request with the stable importer and purchase references.
• Report or verification reference missing: keep supplier information separate from verified actual evidence.
• Disclosure declined or unavailable: record the refusal/limitation and route the unresolved line to the authorised review process.
• No response: preserve the forwarding chain, owner, dates, and next action rather than restarting with disconnected emails.

Importer handoff checklist

The completed handoff should let the importer or authorised declarant see the commercial chain, producing source, disclosure path, evidence state, and unresolved gaps without reconstructing the history from email threads.

Use the supplier request for exact fields, the evidence checklist for completeness, the precursor guide for multi-installation source/version control, and the authorised-declarant or verification guides for their dedicated decisions.

• Importer goods line, CN context, purchase reference, and request ID.
• Every intermediary reference in the order the request travelled.
• Producing operator, installation, goods/process, and reporting-period references.
• O3CI disclosure or direct operator-report path and current version.
• Verification status/reference labelled separately from supplier-reported information.
• Unresolved fields, owner, request date, next review date, and affected downstream line.
• Explicit boundary: no role transfer, filing conclusion, verification conclusion, or sufficiency verdict by CBAM Pulse.