Commission Implementing Regulation (EU) 2024/3210 of 18 December 2024 laying down rules for the application of Regulation (EU) 2023/956 of the European Parliament and of the Council as regards the CBAM registry

The CBAM registry shall be a standardised and secure electronic database containing data elements of CBAM accounts, of CBAM declarations, of applications for the status of authorised CBAM declarant, of importers of the goods listed in Annex I to Regulation (EU) 2023/956, of the registration of the persons delegated to act on behalf of and in the name of those persons, of the registration of operators, of the emission reports, of the registration of verifiers, of verification reports issued by verifiers and supporting documents issued by verifiers, of the independent person referred to in Article 9(2) of Regulation (EU) 2023/956 (the ‘independent person’), as well as of other importers for the purpose of circumvention monitoring as provided for in Article 27 of Regulation (EU) 2023/956, and providing access, case handling and confidentiality.

The CBAM registry shall enable communication, notification, registration, checks and information exchanges between the Commission, the competent authorities, customs authorities and authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, persons delegated to act on behalf of and in the name of those persons, operators, verifiers and independent persons.

The CBAM registry shall allow for the analytical tasks inherent in CBAM risk-analysis functions that the Commission shall perform.

The Commission shall be the system owner of the CBAM registry.

The CBAM registry shall consist of the following components:

The competent authority of the Member State of establishment of the authorised CBAM declarant, and of the importer exceeding the single mass-based threshold referred to in Article 2a of Regulation (EU) 2023/956 (the ‘single-mass based threshold’), and the competent authority of the Member State of establishment of a person other than an authorised CBAM declarant introducing goods into the customs territory of the Union in the case referred to in Article 26, paragraphs 2 and 2a, of Regulation (EU) 2023/956, shall communicate the decisions on penalties to the Commission via the CBAM registry.

The CBAM registry shall be interoperable with the following systems:

The CBAM registry shall allow digital cooperation via the EU Single Window Environment for Customs referred to in Article 3 Regulation (EU) 2022/2399.

Where a competent authority concludes that an importer exceeds the single mass-based threshold laid down in point 1 of Annex VII to Regulation (EU) 2023/956, the customs authorities shall be informed by means of the CRMS2 via the CBAM registry.

The authentication and access verification of the authorised CBAM declarants, applicants, and persons for whom the status of authorised CBAM declarants was revoked, for the purposes of access to the components of the CBAM registry, shall be performed using the UUM&DS system.  The request for authentication and access verification shall be submitted to the competent authority of the Member State of establishment.

The Commission shall provide the authentication services allowing the users of the CBAM registry to securely access the registry.

The Commission shall use UUM&DS to authorise and grant access to the CBAM registry to its staff.

The competent authority of a Member State shall use UUM&DS to authorise and grant access to the CBAM registry to its staff, to authorised CBAM declarants, to applicants, and to persons for whom the status of authorised CBAM declarant was revoked, that are established in that Member State.

The competent authority of a Member State may use an identification and access management system set up in that Member State (national Customs eIDAS system) to provide the necessary credentials to access the CBAM registry.

The applicant, the authorised CBAM declarant, or persons for whom the status of authorised CBAM declarants was revoked, may delegate access to the CBAM registry to persons acting on their behalf. Delegators shall remain responsible for performing their obligations laid down in Regulation (EU) 2023/956.

The CBAM Declarants Portal shall be the unique entry point to the CBAM registry for authorised CBAM declarants, for applicants, persons for whom the status of authorised CBAM declarant was revoked, and persons delegated to act on behalf of and in the name of those persons.

The CBAM Declarants Portal shall be used for the following actions:

Access to the CBAM Declarants Portal shall be managed in accordance with Article 8.

The CBAM Operators Portal shall be the unique entry point to the CBAM registry for operators, verifiers, and independent persons. The portal shall be accessible from the internet.

The CBAM Operators Portal shall be used by operators, verifiers and independent persons in accordance with Articles 9, 10, and 10a of Regulation (EU) 2023/956, respectively, for the following actions:

An operator shall submit a request to the Commission to be assigned a profile to obtain access the CBAM Operators Portal. That request shall be accompanied by supporting documents demonstrating the operator’s legal registration or proof of activity in the third country of establishment, including name, address, contact information, and national corporate or activity registration number. That request shall be accompanied by evidence demonstrating that the person submitting the request is authorised to act on behalf of the operator and by documents proving that person’s identity. Where the supporting documents are sufficient to attest to the accuracy of the information contained therein, the Commission shall assign the requested profile to the requesting operator.

The operator, the verifier and the independent person shall use the EU Access central service operated by the Commission to request access to the CBAM registry.

The independent person shall submit a request for registration in the CBAM registry to the competent authority of the Member State in which the national accreditation body is established. The independent person shall submit the request for registration within two months of the date on which the accreditation was granted, but not before 1 December 2026. The competent authority shall register the information on the independent person in the CBAM registry.

The request for registration referred to in paragraph 4 shall contain the following information:

The competent authority shall notify the independent person of the registration in the CBAM registry. The competent authority shall also notify, through the CBAM registry, the Commission and the other competent authorities of the registration.

The independent person shall notify the competent authority of any changes to the information referred to in paragraph 2 arising after the registration in the CBAM registry. The competent authority shall ensure that the CBAM registry is updated accordingly.

The competent authority shall deregister the independent person from the CBAM registry where that independent person is no longer qualified for a scope of activity relevant for CBAM or where the independent person has not complied with the obligation laid down in paragraph 8. The competent authority shall notify the Commission and the other competent authorities of the deregistration. The competent authority shall delete the information on that independent person from the CBAM registry provided that such information is not necessary for the review of CBAM declarations that have been submitted.

The CBAM National Competent Authorities Portal shall be the unique entry point to the CBAM registry for the competent authorities. The portal shall be accessible from the internet.

The CBAM National Competent Authorities Portal shall be used to carry out the tasks laid down in Regulation (EU) 2023/956, which shall include notifications and communication.

The CBAM registry shall allow the transfer of necessary data to and from the registry to allow the competent authorities to fulfil their obligations.

Access to the CBAM Competent Authorities Portal shall be managed in accordance with Article 8.

The customs authorities shall use and have access to the CBAM registry to validate authorisations and to share additional customs data, where applicable.

The CBAM European Commission Portal shall be the unique entry point to the CBAM registry for the Commission.

The CBAM European Commission Portal shall be used by the Commission to perform the tasks laid down in Regulation (EU) 2023/956.

Access to the CBAM European Commission Portal shall be managed in accordance with Article 8.

The CBAM registry’s components shall be developed, tested, deployed and managed by the Commission, and may be tested by Member States.

The Commission shall design and maintain the common specifications of the interfaces listed in Articles 4, 5 and 11 in close cooperation with Member States.

Where appropriate, the Commission shall define common technical specifications in close cooperation with, and subject to review by, the competent authorities, with a view to deploying them in due time. The Commission and Member States shall collaborate with CBAM declarants, applicants and other stakeholders.

In collaboration with the competent authorities, the Commission shall conduct testing and validation of the interoperability between the CBAM registry and the systems as referred to in Article 5 to ensure that data is cross-checked accurately, efficiently and confidentially.

The Commission shall perform the maintenance of the CBAM registry.

The Commission shall update the components of the CBAM registry to correct malfunctions, and may add new functionalities or alter existing ones.

The Commission shall inform the competent authorities, the authorised CBAM declarants and the operators in advance of changes and updates to the components of the CBAM registry.

In the event of a temporary failure of the CBAM registry, CBAM declarants and applicants shall submit the information required to comply with their obligations in relation to CBAM obligations under Regulation (EU) 2023/956 by the means specified in the CBAM business continuity plan.

The Commission shall inform the competent authorities about any major unavailability of the CBAM registry which will impact the availability levels defined in the Service Level Agreements referred to in Article 7.

The Commission shall inform the authorised CBAM declarants and operators on requirements, major updates and long-lasting unavailability of the CBAM registry in accordance with the CBAM business continuity plan.

The Commission shall support the competent authorities in the use and functioning of the components of the CBAM registry by providing training and communication material.

The competent authorities shall provide the national service desk support to authorised CBAM declarants and applicants.

The Commission shall be the controller for:

The competent authority shall be the controller for:

The competent authority and the Commission shall be joint controllers for:

All information held in the CBAM registry shall be considered confidential.

The operators, verifiers and independent persons, may access their personal data registered in the CBAM registry after their registration in the CBAM registry. In accordance with Articles 9, 10 and 10a of Regulation (EU) 2023/956, authorised CBAM declarants may access personal data registered by operators, verifiers and independent persons in the CBAM registry or otherwise process those data, where authorisation in that respect was granted by the operators in accordance with Article 10(7).

The Commission and the competent authorities may access and otherwise process the personal data and other data from Customs Import Declarations for goods not listed in Annex I to Regulation (EU) 2023/956 in accordance with Articles 15, 19 and 27 of Regulation (EU) 2023/956.

The Commission shall implement appropriate technical and organisational measures for the system security following consultations with competent authorities.

The competent authorities shall implement appropriate organisational measures for the system security.

The technical measures and organisational measures referred to in paragraphs 1 and 2 of this Article shall be designed to:

The Commission and the competent authorities shall notify each other and provide assistance in case of critical security incidents activating the CBAM business continuity plan when such incidents imply a personal data breach in the meaning of Article 4(12) of Regulation (EU) 2016/679 and Article 3(16) of the Regulation (EU) 2018/1725.

The Commission shall conduct regular assessments of the components of the CBAM registry and shall analyse the security and integrity of those components and the confidentiality of the data processed within those components.

When processing personal data for the purposes listed in Article 18, the competent authorities and the Commission shall retain the data only for the time necessary to achieve the purpose, and for a maximum of 7 years from the registering of the personal data in the CBAM registry.

Notwithstanding paragraph 1, where an appeal has been lodged or where court proceedings have begun involving data stored in the CBAM registry, those data shall be retained until the appeal procedure or court proceedings are terminated and shall only be used for the purpose of the appeal procedure or court proceedings.