CBAM Verification: Who Verifies Your Emissions Data (and How the Process Actually Works)

In brief

CBAM verification is the independent audit of a producer's embedded emissions data by an accredited CBAM verifier under Regulation (EU) 2023/956. Without it, importers face default value mark-ups of 10% in 2026, rising to 30% from 2028. Regilient supports CBAM-ready emissions monitoring and supplier data collection before the verification window closes.

Key facts

Why CBAM needs an independent verification layer

The CBAM adjustment is calculated on specific embedded emissions: the actual CO₂ released in producing one tonne of steel, cement, or fertiliser. The entity doing that calculation is also the entity that pays if the number is high. That is a structural conflict of interest baked directly into the mechanism.

Independent verification exists to close that gap. Under Regulation (EU) 2023/956, actual emissions embedded in goods imported from 1 January 2026 must be verified by an accredited CBAM verifier before they can be used in a CBAM declaration. If the producer cannot produce verified data, the declarant falls back on default values with a mandatory mark-up: 10% in 2026, 20% in 2027, and 30% from 2028 onwards (1% for fertilisers) 

What is CBAM verification?

CBAM verification is the independent audit of a third-country operator's embedded emissions data by an accredited CBAM verifier, resulting in a verification report the authorised CBAM declarant includes in the annual CBAM declaration.

The framework rests on two existing ISO standards: EN ISO 14065 (general principles for bodies verifying environmental information) and EN ISO 17029 (general principles for validation and verification bodies). Both have been used in greenhouse gas verification for years, which gives the CBAM regime a credible methodological foundation.

Two things about verification are non-negotiable. It must be independent: the verifier cannot be the operator, the importer, or a related party. And it must be scope-matched: a verifier accredited only for iron and steel cannot verify cement emissions.

Who can become an accredited CBAM verifier

Any legal person can apply. The applicant does not have to be a Big Four firm, an established environmental consultancy, or based in the EU. Third-country verification firms can apply through a national accreditation body (NAB) in an EU Member State that offers CBAM accreditation.

What the applicant must demonstrate:

• Knowledge of EN ISO 14065 and EN ISO 17029, plus data and information auditing competence.
• Deep familiarity with CBAM rules on accreditation, verification, emissions monitoring, calculation, and free allocation adjustment.
• Independence and impartiality from both operators and EU authorities.
• Organisational capacity: staff competence, quality management systems, English-language capability, and language coverage for the operator's country.

The accreditation process is not a rubber stamp. The NAB reviews documentation, carries out an on-site visit of the applicant's premises, assesses the quality management system, and witnesses staff performing verification work. Accreditation is valid for five years, subject to annual surveillance, and can be limited in scope, suspended, or withdrawn.

Scope is the trap most operators do not see. A verifier accredited for iron and steel is not automatically accredited for aluminium. If your CBAM goods span categories, either your verifier's scope covers all of them or you need more than one verifier. Confirm scope before you sign the engagement letter.

How site visits work under CBAM verification

For a first verification, a physical on-site visit is required, with almost no exceptions. The verifier needs to see the equipment, walk the process, and understand how the facility actually operates.

From the second year onwards, the rules loosen. A visit can be virtual, or in some cases waived entirely, if the installation is not overly complex, no significant changes have been made since the last physical visit, and the verifier can obtain and assess all relevant information remotely with reasonable assurance the emissions report is free from material misstatement 

A force majeure route exists for cases where physical travel is impossible. The Commission has explicitly allowed virtual visits for installations in Ukraine due to the ongoing war. A separate rule allows electricity installations that emit no greenhouse gases to skip the site visit if at least one physical visit occurred in the last five reporting periods.

The 2026–2027 verification window

The definitive CBAM period is already running, but no accredited CBAM verifier exists yet. That gap is the timeline problem compliance teams should be solving now.

The first annual CBAM declarations are due on 30 September 2027 for goods imported during 2026. First CBAM accreditations are expected around September 2026. That leaves roughly six to twelve months to complete monitoring, engage an accredited verifier, and get the verification report ready for the declaration.

The Commission's own guidance is explicit: operators may already establish contact with verifiers seeking accreditation. Waiting until accreditation is formally granted is the fastest route into a bottleneck.

One further complication for 2026 imports: goods produced before 1 January 2026 but imported during 2026 are still in scope, but no accredited CBAM verifier existed before that date. For those goods, default values must be used.

Ask yourself: if the verification report for your September 2027 declaration is not ready by June 2027, what is your fallback? If the answer is "default values," you already know your CBAM exposure for 2026. If it is "we do not know," that is the gap this section is pointing to.

Who is legally liable for verification errors

The authorised CBAM declarant is the only person legally responsible for the content of the CBAM declaration. That includes the verification report.

If the verification report contains an error that affects the number of CBAM certificates surrendered, the declarant can be penalised, even if the error originated with the verifier. The Commission's Q&A offers one partial mitigation: where the error results from incorrect information provided by a third party, the national competent authority may reduce the penalty. "May," and not "will."

Two operational consequences follow. Verifier selection is a risk management decision, not a procurement exercise: cheap verification that produces defective reports transfers the cost, not the risk. And dialogue with the national competent authority is worth building early. The Commission describes this cooperation as essential.

One further liability signal: unsolicited verification offers are almost certainly scams. No legitimate verifier can produce a verified CBAM emissions report before accreditation is granted, and accreditations are not expected before September 2026. Any organisation offering paid CBAM verification services to importers today should be treated with serious scepticism.

Precursors and complex goods

CBAM verification gets harder when the imported good is a complex good: one whose production uses precursor materials that are themselves CBAM goods.

Embedded emissions in precursors follow the same rule as the final good. Either default values, or actual verified emissions. If the operator of the complex good wants to use actual verified emissions for a precursor produced elsewhere, the operator of that upstream installation must also have their emissions verified, and the verifier of the complex good must review the precursor's verification report as part of their own engagement.

From 2028 onwards, operators will be able to share actual verified precursor emissions via the CBAM Registry. Until then, they must exchange this data outside the Registry, which puts the coordination burden on the supply chain itself. For multi-tier supply chains, typical in steel and aluminium, this is where verification timelines quietly blow out.

The verification report itself must be issued in English, and the verification team must include a CBAM lead auditor able to communicate in English plus at least one auditor able to communicate in the operator's language. For installations across non-English-speaking Asia, Africa, and Latin America, this is a real constraint on which verifiers can even be engaged.

How Regilient fits into your CBAM verification workflow

Regilient does not verify emissions. That is deliberate: verification must remain independent, and CBAM prohibits verifier conflicts of interest. Regilient's CBAM compliance software does the work that has to happen before and around verification.

That means helping operators structure emissions monitoring so the numbers a verifier is asked to sign off on are defensible, traceable, and CBAM-methodology-aligned from day one. It means supplier engagement for precursor data, so complex-goods declarants are not chasing upstream emissions in email chains three weeks before the deadline. It means regulatory alerts on default value updates, mark-up changes, and Commission guidance, so declarants are not reading EUR-Lex on the weekend before a declaration. And it means mapping verified emissions data directly to the fields the CBAM declaration will need.

If your team is treating verification as an early-2027 problem, the timeline earlier in this post is the argument for starting now. If verification is already in motion, the value is in the coordination layer around it.

Book a Regilient demo →