Getting Started With CBAM: A First 90 Days Guide

Most exporters don't fail at CBAM because the regulation is impossible to understand. They fail because they wait for a complete understanding before doing anything — and by the time that arrives, they've lost several months of activity data they can never recover. This guide is the order of operations that avoids that trap.

Week 1–2: Confirm You're Actually in Scope

CBAM's definitive regime covers iron and steel, aluminium, cement, fertilisers, hydrogen, and electricity — identified by CN (Combined Nomenclature) code, not by industry label. The practical first step isn't reading the regulation cover to cover; it's pulling your actual export CN codes and checking them against the CBAM goods list. Two things catch people out here:

• Downstream and precursor goods are gradually being pulled in — engineering goods, auto components, fasteners, castings and forgings can carry embedded emissions from CBAM-covered inputs even if the finished product isn't itself on the primary list.
• Scope is per shipment, not per company. A firm exporting three product lines to the EU might be in scope for one and not the others — worth knowing before you build reporting for everything.

Week 2–3: Map Your Installations and Processes

CBAM reports at the installation level, not the company level. If you have two plants, you have two separate reporting obligations, potentially with different production processes and different precursor supply chains. Before touching any data entry, write down: which physical installations produce CBAM goods, which production processes run at each one (a blast furnace and an electric arc furnace are reported differently), and which precursor materials you buy in versus produce on-site.

Week 3–6: Start Capturing Monthly Activity Data — Even Imperfectly

This is the step people delay the longest, and it's the one that costs the most to delay. CBAM's Summary Communication is built from monthly activity data — fuel consumption, source stream emissions, electricity use, production volumes — rolled up over a reporting period. You cannot retroactively generate March's meter readings in September. Start capturing now, with whatever data quality you currently have, and improve the quality later. An imperfect number entered this month beats a perfect number you'll never be able to reconstruct.

This is also where the gap between real and provable shows up first. If you've invested in solar power, waste heat recovery, or efficient furnaces, this is where that investment either gets captured as a real, favourable number — or gets left out, in which case the EU will fill the gap with its own, less flattering default value.

Week 6–8: Understand Where Default Values Will Hurt You

For complex goods, up to 20% of total embedded emissions may be determined using EU-published default values instead of your own measured data — a legitimate fallback when real data genuinely isn't available. The problem is when it becomes the default by neglect rather than necessity. Default values are consistently set above what most real, reasonably efficient installations actually produce, because they're calibrated conservatively across an entire industry. Every real measurement you can substitute in is one less line item priced against you.

Week 8–10: Put Your Monitoring Plan on Paper

The EU's own guidance (§6.4) expects a documented monitoring methodology: who's responsible for which data, where it comes from, how often it's collected, and what happens when a data source is temporarily unavailable. Most exporters build this reactively, after a verifier asks for it. Building it proactively — even a first draft — forces the same clarity a verifier will eventually demand, on your own timeline instead of theirs.

Week 10–12: Run a Practice Summary Communication

Before your first report is actually due, generate one anyway, using whatever real data you've captured so far. This surfaces gaps — a process with no registered emission factor, a precursor supplier who's never sent usable data, a month where nobody entered anything — while there's still time to fix them, instead of during the reporting window itself.

Ongoing: Line Up Verification Before You Need It

An ISO 14064-3-aligned verification engagement — risk assessment, sampling, findings, formal opinion — takes real time to run properly, and a rushed verification the week a declaration is due helps nobody. Start the conversation with an accredited verifier once you have a few months of real activity data behind you, not after your first customer asks for a verified report by Friday.