Commission Implementing Regulation (EU) 2025/2550 of 10 December 2025 amending and correcting Implementing Regulation (EU) 2024/3210 as regards the CBAM registry

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2023/956 of the European Parliament and of the Council of 10 May 2023 establishing a carbon border adjustment mechanism [^ntr1-L_202502550EN.000101-E0001], and in particular Article 14(6) thereof,

Whereas:

• (1) Regulation (EU) 2023/956 was amended by Regulation (EU) 2025/2083 of the European Parliament and of the Council [^ntr2-L_202502550EN.000101-E0002]. The effects of the amendments to Regulation (EU) 2023/956 include, among other things, the introduction of the possibility for an authorised CBAM declarant to delegate the submission of CBAM declarations to a person acting on behalf of and in the name of that authorised CBAM declarant, of rules on registration of verifiers, and of a single mass-based threshold, as well as rules on the monitoring of that threshold.

• (2) It is necessary to update certain provisions of Commission Implementing Regulation (EU) 2024/3210 [^ntr3-L_202502550EN.000101-E0003] to make them consistent with the new terminology and requirements set out in Regulation (EU) 2023/956.

• (3) The CBAM registry, which was established by Implementing Regulation (EU) 2024/3210, is interoperable with other electronic customs systems. Commission Implementing Regulation (EU) 2023/1070 [^ntr4-L_202502550EN.000101-E0004], which sets out the technical arrangements for such electronic systems, has been repealed and replaced by Commission Implementing Regulation (EU) 2025/512 [^ntr5-L_202502550EN.000101-E0005]. It is therefore necessary to update the references to Implementing Regulation (EU) 2023/1070 in Article 5 of Implementing Regulation (EU) 2024/3210.

• (4) To ensure that certification reports can be generated in the CBAM registry, and therefore to facilitate the certification process and safeguard the authenticity of certification reports, it is necessary to provide for access to and use of the CBAM registry by the independent person referred to in Article 9(2) of Regulation (EU) 2023/956. To provide sufficient time for the design of the appropriate technical solution, and to ensure consistency with the registration of verifiers, such access should be granted no earlier than on 1 December 2026.

• (5) Article 3(2), Article 9(1), Article 19(2), point (c), and Article 21(1) of Implementing Regulation (EU) 2024/3210 contain a mistake regarding the list of persons with access to the CBAM registry. For clarity, those errors should be corrected.

• (6) It is necessary to specify the request for registration by the UUM & DS, so that the persons delegated to act on behalf of and in the name of the applicants, the authorised CBAM declarants or the persons holding a revoked authorisation, can gain access to the CBAM registry.

• (7) In accordance with Article 14(6) of Regulation (EU) 2023/956, the customs authorities are to have access to the information in the CBAM registry. In order to ensure the accuracy of customs information, the customs authorities should use and have access to the CBAM registry to validate authorisations and to share additional customs data, in addition the automated exchange of information and the customs systems that are interoperable with the CBAM registry.

• (8) In order to set up the infrastructure, this implementing act should also specify the process related to the exchange of information and data in the CBAM registry between the Commission and the competent authorities in accordance with Articles 15 and 27 of Regulation (EU) 2023/956. When referring to transfer of data in Article 11(3) of Implementing Regulation (EU) 2024/3210, it should be understood as transfer and export of relevant and necessary information from the CBAM registry to enable the competent authority to perform their tasks under Regulation (EU) 2023/956.

• (9) The competent authorities and the Commission process personal data registered in the CBAM registry in line with their tasks as specified in Regulation (EU) 2023/956. It is necessary to clarify the data retention period provided for in Implementing Regulation (EU) 2024/3210 in order to align with the amendments introduced in Regulation (EU) 2023/956.

• (10) The date of application of the provisions in this Regulation relating to the functioning of the CBAM registry should be aligned with the date of application of the related provisions of Regulation (EU) 2023/956. This Regulation should apply from 1 January 2026, for the provisions related to the introduction and the monitoring of the single mass-based threshold, for the registration of the independent persons and verifiers, and for the process related to the exchange of information and data in the CBAM Registry between the Commission and the competent authorities as referred to in Articles 15 and 27 of Regulation (EU) 2023/956.

• (11) Implementing Regulation (EU) 2024/3210 should therefore be amended and corrected accordingly.

• (12) The measures provided for in this Regulation are in accordance with the opinion of the CBAM Committee,

HAS ADOPTED THIS REGULATION:

Article 1

Amendments and corrections to Implementing Regulation (EU) 2024/3210

Implementing Regulation (EU) 2024/3210 is amended and corrected as follows:

• (1) in Article 3, paragraphs 1 and 2 are replaced and corrected by the following:

‘1.   The CBAM registry shall be a standardised and secure electronic database containing data elements of CBAM accounts, of CBAM declarations, of applications for the status of authorised CBAM declarant, of importers of the goods listed in Annex I to Regulation (EU) 2023/956, of the registration of the persons delegated to act on behalf of and in the name of those persons, of the registration of operators, of the emission reports, of the registration of verifiers, of verification reports issued by verifiers and supporting documents issued by verifiers, of the independent person referred to in Article 9(2) of Regulation (EU) 2023/956 (the “independent person”), as well as of other importers for the purpose of circumvention monitoring as provided for in Article 27 of Regulation (EU) 2023/956, and providing access, case handling and confidentiality.

1. The CBAM registry shall enable communication, notification, registration, checks and information exchanges between the Commission, the competent authorities, customs authorities and authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, persons delegated to act on behalf of and in the name of those persons, operators, verifiers and independent persons.’

;

• (2) in Article 4, paragraph 2 is replaced by the following:

‘2.   The competent authority of the Member State of establishment of the authorised CBAM declarant, and of the importer exceeding the single mass-based threshold referred to in Article 2a of Regulation (EU) 2023/956 (the “single-mass based threshold”), and the competent authority of the Member State of establishment of a person other than an authorised CBAM declarant introducing goods into the customs territory of the Union in the case referred to in Article 26, paragraphs 2 and 2a, of Regulation (EU) 2023/956, shall communicate the decisions on penalties to the Commission via the CBAM registry.’

;

• (3) Article 5 is amended as follows:

• (a) paragraph 1 is amended as follows:

• (i) points (a), (b) and (c) are replaced by the following:

• ‘(a) the Uniform User Management and Digital Signature (UUM & DS) system for users’ registration and access management referred to in Article 16 of Commission Implementing Regulation (EU) 2025/512[^ntr*1-L_202502550EN.000101-E0006] for the Member States, the Commission, the authorised CBAM declarants, the applicants, the persons holding a revoked authorisation, and the persons delegated to act on behalf of and in the name of those persons;

• (b) the Economic Operator Registration and Identification (EORI) system referred to in Article 30 of Implementing Regulation (EU) 2025/512 enabling the cross-checking of the EORI data set out in the Annex to this Regulation;

• (c) the Surveillance system, developed through the UCC Surveillance 3 (SURV3) system referred to in Article 100 of Implementing Regulation (EU) 2025/512;

[^ntr*1-L_202502550EN.000101-E0006]: Commission Implementing Regulation (EU) 2025/512 of 13 March 2025 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and of the Council (OJ L, 2025/512, 20.3.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/512/oj).’;"

• (ii) point (e) is replaced by the following:

• ‘(e) the Customs Risk Management System (CRMS2) referred to in Article 36 of Implementing Regulation (EU) 2015/2447 and in Article 70 of Implementing Regulation (EU) 2025/512;’;

• (b) the following paragraph 3 is added:

‘3.   Where a competent authority concludes that an importer exceeds the single mass-based threshold laid down in point 1 of Annex VII to Regulation (EU) 2023/956, the customs authorities shall be informed by means of the CRMS2 via the CBAM registry.’

;

• (4) in Article 6, the first subparagraph, is amended as follows:

‘The Commission and the national competent authorities shall designate contact points for each of the systems referred to in Articles 4 and 5 for exchanging information to ensure a coordinated development, operation, and maintenance of those components. The customs authorities shall also designate contact points for CBAM purposes. The competent authorities and customs authorities may use existing contact points.’;

• (5) Article 8 is amended as follows:

• (a) in paragraph 1, the following sentence is added:

‘The request for authentication and access verification shall be submitted to the competent authority of the Member State of establishment.’;

• (b) in paragraph 6, the following subparagraphs are added:

‘Where the applicant, the authorised CBAM declarant, or the person for whom the status of authorised CBAM declarant was revoked, delegates access to the CBAM registry, thepersonshall be identified by the credentials used for the UUM & DS access management referred to in paragraphs 1 and 5.

That person may, at any time, ask to be deregistered from the CBAM registry. Upon such request, the competent authority of the Member State that granted access to the CBAM registry shall deactivate the access to the CBAM registry using the UUM & DS system.’;

• (6) Article 9 is amended and corrected as follows:

• (a) in paragraph 1, the first sentence is replaced by the following:

‘The CBAM Declarants Portal shall be the unique entry point to the CBAM registry for authorised CBAM declarants, for applicants, persons for whom the status of authorised CBAM declarant was revoked, and persons delegated to act on behalf of and in the name of those persons.’;

• (b) in paragraph 2, the following point (d) is added:

• ‘(d) using information provided by the CBAM Operators Portal.’;

• (7) Article 10 is amended as follows:

• (a) paragraph 1 is replaced by the following:

‘1.   The CBAM Operators Portal shall be the unique entry point to the CBAM registry for operators, verifiers, and independent persons. The portal shall be accessible from the internet.’

;

• (b) paragraph 2 is amended as follows:

• (i) the introductory phrase is replaced by the following:

‘The CBAM Operators Portal shall be used by operators, verifiers and independent persons in accordance with Articles 9, 10, and 10a of Regulation (EU) 2023/956, respectively, for the following actions:’;

• (ii) the following points (ca) and (cb) are inserted:

• ‘(ca) facilitating the verification and certification of the information registered by the operator, the verifier or the authorised CBAM declarant;

• (cb) facilitating the exchange of information between the operator, the verifier, the independent person and the authorised CBAM declarant;’;

• (c) paragraph 4 is replaced by the following:

‘4.   The operator, the verifier and the independent person shall use the EU Access central service operated by the Commission to request access to the CBAM registry.’

;

• (d) the following paragraphs 5 to 9 are added:

‘5.   The independent person shall submit a request for registration in the CBAM registry to the competent authority of the Member State in which the national accreditation body is established. The independent person shall submit the request for registration within two months of the date on which the accreditation was granted, but not before 1 December 2026. The competent authority shall register the information on the independent person in the CBAM registry.

1. The request for registration referred to in paragraph 4 shall contain the following information:

• (a) the name and unique accreditation identification of the independent person;

• (b) any scope of accreditation relevant for CBAM;

• (c) the country of establishment of the independent person;

• (d) the effective date of certification and expiry date of certification;

• (e) any information on administrative measures imposed on the independent person relevant for CBAM;

• (f) a copy of the accreditation certificate relevant for CBAM.

1. The competent authority shall notify the independent person of the registration in the CBAM registry. The competent authority shall also notify, through the CBAM registry, the Commission and the other competent authorities of the registration.

1. The independent person shall notify the competent authority of any changes to the information referred to in paragraph 2 arising after the registration in the CBAM registry. The competent authority shall ensure that the CBAM registry is updated accordingly.

1. The competent authority shall deregister the independent person from the CBAM registry where that independent person is no longer qualified for a scope of activity relevant for CBAM or where the independent person has not complied with the obligation laid down in paragraph 8. The competent authority shall notify the Commission and the other competent authorities of the deregistration. The competent authority shall delete the information on that independent person from the CBAM registry provided that such information is not necessary for the review of CBAM declarations that have been submitted.’

;

• (8) in Article 11, the following paragraph 5 is added:

‘5.   The customs authorities shall use and have access to the CBAM registry to validate authorisations and to share additional customs data, where applicable.’

;

• (9) in Article 12, the following paragraphs 2a and 2b are inserted:

‘2a.   The CBAM European Commission Portal shall be interoperable with a separate section for the Commission to perform the tasks laid down in Articles 15 and 27 of Regulation (EU) 2023/956.

2b.   The Commission shall register and make available any relevant information and data to the competent authorities via the CBAM National Competent Authorities Portal in accordance with Article 11 of this Regulation where such information and data are deemed necessary for the competent authorities to perform their tasks under Regulation (EU) 2023/956.’

;

• (10) in Article 18, point (e) is replaced by the following:

• ‘(e) operator, verifier and independent person management;’;

• (11) Article 19 is amended and corrected as follows:

• (a) in paragraph 2, point (c) is replaced by the following:

• ‘(c) the processing of personal data for the access management of the authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, and persons delegated to act on behalf of and in the name of those persons, established within their Member State in accordance with Articles 8, 11 and 13 of this Regulation;’;

• (b) in paragraph 3, the following point (d) is added:

• ‘(d) the personal data processing for the monitoring of the single mass-based threshold in accordance with Article 2a of Regulation (EU) 2023/956.’;

• (12) Article 21 is amended and corrected as follows:

• (a) in paragraph 1, the second subparagraph is replaced by the following:

‘The authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, and persons delegated to act on behalf of and in the name of those persons may access their personal data registered in the CBAM registry after their registration in the registry.’;

• (b) paragraph 2 is replaced by the following:

‘2.   The operators, verifiers and independent persons, may access their personal data registered in the CBAM registry after their registration in the CBAM registry. In accordance with Articles 9, 10 and 10a of Regulation (EU) 2023/956, authorised CBAM declarants may access personal data registered by operators, verifiers and independent persons in the CBAM registry or otherwise process those data, where authorisation in that respect was granted by the operators in accordance with Article 10(7).’

;

• (13) in Article 23(1), the following subparagraph is added:

‘The date of registration of the personal data referred to in the first subparagraph shall be the earliest of the following dates:

• (a) the competent authority refuses to grant the status of authorised CBAM declarant;

• (b) the status of authorised CBAM declarant is revoked;

• (c) an operator, verifier, independent person or the person delegated to act on behalf of and in the name of those persons was deregistered from the CBAM registry.’.

Article 2

Entry into force and application

This Regulation shall enter into force on the third day following that of its publication in the Official Journal of the European Union.

Article 1 , points (7), and (10), shall apply from 1 January 2026.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 10 December 2025.

For the Commission

The President

Ursula VON DER LEYEN

[^ntr1-L_202502550EN.000101-E0001]: OJ L 130, 16.5.2023, p. 52, ELI: http://data.europa.eu/eli/reg/2023/956/oj.

[^ntr2-L_202502550EN.000101-E0002]: Regulation (EU) 2025/2083 of the European Parliament and of the Council of 8 October 2025 amending Regulation (EU) 2023/956 as regards simplifying and strengthening the carbon border adjustment mechanism (OJ L, 2025/2083, 17.10.2025, ELI: http://data.europa.eu/eli/reg/2025/2083/oj).

[^ntr3-L_202502550EN.000101-E0003]: Commission Implementing Regulation (EU) 2024/3210 of 18 December 2024 laying down rules for the application of Regulation (EU) 2023/956 of the European Parliament and of the Council as regards the CBAM registry (OJ L, 2024/3210, 30.12.2024, ELI: http://data.europa.eu/eli/reg_impl/2024/3210/oj).

[^ntr4-L_202502550EN.000101-E0004]: Commission Implementing Regulation (EU) 2023/1070 of 1 June 2023 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and the Council (OJ L 143, 2.6.2023, p. 65, ELI: http://data.europa.eu/eli/reg_impl/2023/1070/oj).

[^ntr5-L_202502550EN.000101-E0005]: Commission Implementing Regulation (EU) 2025/512 of 13 March 2025 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and of the Council (OJ L, 2025/512, 20.3.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/512/oj).

ELI: http://data.europa.eu/eli/reg_impl/2025/2550/oj

ISSN 1977-0677 (electronic edition)