CBAM Desk

CBAM 2026 source version control: which document actually governs your evidence

Sources checked

CBAM has been in its definitive phase since 1 January 2026, covering imports in six sectors: cement, iron and steel, aluminium, fertilisers, electricity, and hydrogen. Before applying the 50-tonne threshold, first confirm the product is in scope — the figure is a single mass-based trigger for those six CBAM sectors and is not a universal exemption or an automatic pass/fail test for every product or case. For sector-specific requirements, including those for electricity and hydrogen, the Commission links further information on a dedicated sectors page; that material is outside this article and has not been reviewed here, and the 50-tonne mass-based threshold must not be applied to it automatically. EU importers — or their indirect customs representatives — who import more than 50 tonnes of in-scope CBAM goods into the EU are required to apply for authorised CBAM declarant status, declare the emissions embedded in those imports each year, and surrender the corresponding certificates.

That chain is straightforward on paper. The part that decides whether the evidence holds up is harder: every number you report has to be traceable to a named source, at a named version, on a known date. That is ordinary editorial and process guidance, not certified or legal advice — but it is where most file handovers quietly break.

What "source version" actually means in practice

A figure like "2.4 t CO₂e per tonne of product" is not evidence on its own. It is evidence once someone else can reopen the file it came from and land on the same figure. That requires three things recorded together, not one:

  • The document identity — regulation number, guidance document number, or installation's own monitoring report reference.
  • The version state at the moment of use — an adoption date, an amending act already folded in, a document marked "information purposes only" or legally binding.
  • The date of retrieval, because published materials get replaced.

Record all three in the same row as the figure. Separate columns in a spreadsheet drift apart; a single evidence line does not.

Which document wins when two documents disagree

In the default values area, the source page states that the Excel file is made available for information purposes only, while the legally binding values are set out in the implementing regulation itself — Commission Implementing Regulation (EU) 2025/2621, as corrected by Commission Implementing Regulation (EU) 2026/1740. As of the14 October 2026 check of that page, it states that a consolidated version of 2025/2621 will be available soon, so treat any consolidated text you encounter as newer than this statement and re-check its date. Benchmarks follow the same pattern: set out in Commission Implementing Regulation (EU) 2025/2620, with the spreadsheet again only informational.

So the practical rule is narrow and worth writing into your own procedure: when a spreadsheet cell and the regulation text differ, the regulation text is the value you report, and the spreadsheet is only a working aid.

Non-EU suppliers: which document do you cite

For installations outside the EU, the legislation and guidance page lists a series of ten guidance documents published on 14 August 2026 to help non-EU operators implement CBAM in its definitive period — from Guidance No. 1 on CBAM concepts through No. 3 on calculating embedded emissions, to the six sector-specific documents (No. 5a cement through No. 5f electricity). Cite the guidance number and its publication date alongside your calculation method.

Keep one caveat in view. A guidance document and a regulation answer different questions. Guidance explains how to apply the rules; the regulation sets them. Where your method paper leans on a guidance statement, name the guidance document — do not present it as though it were the legal requirement.

Access and identity controls sit upstream of the evidence

Two more version questions get asked late and answered badly:

  • Authorisation. Importers (or their indirect customs representatives) are encouraged to follow the instructions in the Authorisation Management Module and submit their applications for authorised CBAM declarant status there. Authorised CBAM declarants buy CBAM certificates from the national competent authority in their EU country of establishment.
  • Registry access. Access to the CBAM Registry can be requested through the National Competent Authority (NCA) of the EU country in which the importer is established, as stated in the "National Competent Authorities" section of the CBAM definitive regime page. As our own workflow advice — not a legal requirement — if the entity that holds the access differs from the entity that holds the evidence, list both names in the evidence header.

Carbon price already paid

If importers can prove that a carbon price has already been paid during the production of the imported goods, the corresponding amount can be deducted (CBAM definitive regime). Deduction claims are exactly where source versioning bites: the price evidence is produced in another jurisdiction, under another set of rules. Attach the original document, its version, and the date, and keep the deduction calculation reproducible from those files alone.

A working checklist

Editorial guidance only, not certified advice:

  1. Name the regulation or guidance number for every reported figure.
  2. Note whether the file you used is binding or "for information purposes only."
  3. Record the amending acts already incorporated.
  4. Stamp the retrieval date next to the citation.
  5. Keep one evidence line per figure, not scattered attachments.
  6. Re-check before each annual surrender whether a correction notice has replaced the file you cited.

Official sources

  • CBAM definitive regime — Checked: 2026-10-14 — source for the definitive-regime obligations, the NCA-based Registry access route, and the sectors list
  • CBAM legislation and guidance — Checked: 2026-10-14 — lists Regulations 2025/2620, 2025/2621, 2026/1740 and the 14 August 2026 guidance documents
  • CBAM Registry and reporting — Not checked; the Registry access statement above is drawn from the definitive-regime page instead