Implementing Regulation (EU) 2024/3210 is amended and corrected as follows:
(1)
in Article 3, paragraphs 1 and 2 are replaced and corrected by the following:
‘1. The CBAM registry shall be a standardised and secure electronic database containing data elements of CBAM accounts, of CBAM declarations, of applications for the status of authorised CBAM declarant, of importers of the goods listed in Annex I to Regulation (EU) 2023/956, of the registration of the persons delegated to act on behalf of and in the name of those persons, of the registration of operators, of the emission reports, of the registration of verifiers, of verification reports issued by verifiers and supporting documents issued by verifiers, of the independent person referred to in Article 9(2) of Regulation (EU) 2023/956 (the “independent person”), as well as of other importers for the purpose of circumvention monitoring as provided for in Article 27 of Regulation (EU) 2023/956, and providing access, case handling and confidentiality.
2. The CBAM registry shall enable communication, notification, registration, checks and information exchanges between the Commission, the competent authorities, customs authorities and authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, persons delegated to act on behalf of and in the name of those persons, operators, verifiers and independent persons.’
;
(2)
in Article 4, paragraph 2 is replaced by the following:
‘2. The competent authority of the Member State of establishment of the authorised CBAM declarant, and of the importer exceeding the single mass-based threshold referred to in Article 2a of Regulation (EU) 2023/956 (the “single-mass based threshold”), and the competent authority of the Member State of establishment of a person other than an authorised CBAM declarant introducing goods into the customs territory of the Union in the case referred to in Article 26, paragraphs 2 and 2a, of Regulation (EU) 2023/956, shall communicate the decisions on penalties to the Commission via the CBAM registry.’
;
(3)
Article 5 is amended as follows:
(a)
paragraph 1 is amended as follows:
(i)
points (a), (b) and (c) are replaced by the following:
‘(a)
the Uniform User Management and Digital Signature (UUM & DS) system for users’ registration and access management referred to in Article 16 of Commission Implementing Regulation (EU) 2025/512 ( *1 ) for the Member States, the Commission, the authorised CBAM declarants, the applicants, the persons holding a revoked authorisation, and the persons delegated to act on behalf of and in the name of those persons;
(b)
the Economic Operator Registration and Identification (EORI) system referred to in Article 30 of Implementing Regulation (EU) 2025/512 enabling the cross-checking of the EORI data set out in the Annex to this Regulation;
(c)
the Surveillance system, developed through the UCC Surveillance 3 (SURV3) system referred to in Article 100 of Implementing Regulation (EU) 2025/512;
( *1 ) Commission Implementing Regulation (EU) 2025/512 of 13 March 2025 on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under Regulation (EU) No 952/2013 of the European Parliament and of the Council ( OJ L, 2025/512, 20.3.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/512/oj ).’;"
(ii)
point (e) is replaced by the following:
‘(e)
the Customs Risk Management System (CRMS2) referred to in Article 36 of Implementing Regulation (EU) 2015/2447 and in Article 70 of Implementing Regulation (EU) 2025/512;’;
(b)
the following paragraph 3 is added:
‘3. Where a competent authority concludes that an importer exceeds the single mass-based threshold laid down in point 1 of Annex VII to Regulation (EU) 2023/956, the customs authorities shall be informed by means of the CRMS2 via the CBAM registry.’
;
(4)
in Article 6, the first subparagraph, is amended as follows:
‘The Commission and the national competent authorities shall designate contact points for each of the systems referred to in Articles 4 and 5 for exchanging information to ensure a coordinated development, operation, and maintenance of those components. The customs authorities shall also designate contact points for CBAM purposes. The competent authorities and customs authorities may use existing contact points.’;
(5)
Article 8 is amended as follows:
(a)
in paragraph 1, the following sentence is added:
‘The request for authentication and access verification shall be submitted to the competent authority of the Member State of establishment.’;
(b)
in paragraph 6, the following subparagraphs are added:
‘Where the applicant, the authorised CBAM declarant, or the person for whom the status of authorised CBAM declarant was revoked, delegates access to the CBAM registry, thepersonshall be identified by the credentials used for the UUM & DS access management referred to in paragraphs 1 and 5.
That person may, at any time, ask to be deregistered from the CBAM registry. Upon such request, the competent authority of the Member State that granted access to the CBAM registry shall deactivate the access to the CBAM registry using the UUM & DS system.’;
(6)
Article 9 is amended and corrected as follows:
(a)
in paragraph 1, the first sentence is replaced by the following:
‘The CBAM Declarants Portal shall be the unique entry point to the CBAM registry for authorised CBAM declarants, for applicants, persons for whom the status of authorised CBAM declarant was revoked, and persons delegated to act on behalf of and in the name of those persons.’;
(b)
in paragraph 2, the following point (d) is added:
‘(d)
using information provided by the CBAM Operators Portal.’;
(7)
Article 10 is amended as follows:
(a)
paragraph 1 is replaced by the following:
‘1. The CBAM Operators Portal shall be the unique entry point to the CBAM registry for operators, verifiers, and independent persons. The portal shall be accessible from the internet.’
;
(b)
paragraph 2 is amended as follows:
(i)
the introductory phrase is replaced by the following:
‘The CBAM Operators Portal shall be used by operators, verifiers and independent persons in accordance with Articles 9, 10, and 10a of Regulation (EU) 2023/956, respectively, for the following actions:’;
(ii)
the following points (ca) and (cb) are inserted:
‘(ca)
facilitating the verification and certification of the information registered by the operator, the verifier or the authorised CBAM declarant;
(cb)
facilitating the exchange of information between the operator, the verifier, the independent person and the authorised CBAM declarant;’;
(c)
paragraph 4 is replaced by the following:
‘4. The operator, the verifier and the independent person shall use the EU Access central service operated by the Commission to request access to the CBAM registry.’
;
(d)
the following paragraphs 5 to 9 are added:
‘5. The independent person shall submit a request for registration in the CBAM registry to the competent authority of the Member State in which the national accreditation body is established. The independent person shall submit the request for registration within two months of the date on which the accreditation was granted, but not before 1 December 2026. The competent authority shall register the information on the independent person in the CBAM registry.
6. The request for registration referred to in paragraph 4 shall contain the following information:
(a)
the name and unique accreditation identification of the independent person;
(b)
any scope of accreditation relevant for CBAM;
(c)
the country of establishment of the independent person;
(d)
the effective date of certification and expiry date of certification;
(e)
any information on administrative measures imposed on the independent person relevant for CBAM;
(f)
a copy of the accreditation certificate relevant for CBAM.
7. The competent authority shall notify the independent person of the registration in the CBAM registry. The competent authority shall also notify, through the CBAM registry, the Commission and the other competent authorities of the registration.
8. The independent person shall notify the competent authority of any changes to the information referred to in paragraph 2 arising after the registration in the CBAM registry. The competent authority shall ensure that the CBAM registry is updated accordingly.
9. The competent authority shall deregister the independent person from the CBAM registry where that independent person is no longer qualified for a scope of activity relevant for CBAM or where the independent person has not complied with the obligation laid down in paragraph 8. The competent authority shall notify the Commission and the other competent authorities of the deregistration. The competent authority shall delete the information on that independent person from the CBAM registry provided that such information is not necessary for the review of CBAM declarations that have been submitted.’
;
(8)
in Article 11, the following paragraph 5 is added:
‘5. The customs authorities shall use and have access to the CBAM registry to validate authorisations and to share additional customs data, where applicable.’
;
(9)
in Article 12, the following paragraphs 2a and 2b are inserted:
‘2a. The CBAM European Commission Portal shall be interoperable with a separate section for the Commission to perform the tasks laid down in Articles 15 and 27 of Regulation (EU) 2023/956.
2b. The Commission shall register and make available any relevant information and data to the competent authorities via the CBAM National Competent Authorities Portal in accordance with Article 11 of this Regulation where such information and data are deemed necessary for the competent authorities to perform their tasks under Regulation (EU) 2023/956.’
;
(10)
in Article 18, point (e) is replaced by the following:
‘(e)
operator, verifier and independent person management;’;
(11)
Article 19 is amended and corrected as follows:
(a)
in paragraph 2, point (c) is replaced by the following:
‘(c)
the processing of personal data for the access management of the authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, and persons delegated to act on behalf of and in the name of those persons, established within their Member State in accordance with Articles 8, 11 and 13 of this Regulation;’;
(b)
in paragraph 3, the following point (d) is added:
‘(d)
the personal data processing for the monitoring of the single mass-based threshold in accordance with Article 2a of Regulation (EU) 2023/956.’;
(12)
Article 21 is amended and corrected as follows:
(a)
in paragraph 1, the second subparagraph is replaced by the following:
‘The authorised CBAM declarants, applicants, persons for whom the status of authorised CBAM declarants was revoked, and persons delegated to act on behalf of and in the name of those persons may access their personal data registered in the CBAM registry after their registration in the registry.’;
(b)
paragraph 2 is replaced by the following:
‘2. The operators, verifiers and independent persons, may access their personal data registered in the CBAM registry after their registration in the CBAM registry. In accordance with Articles 9, 10 and 10a of Regulation (EU) 2023/956, authorised CBAM declarants may access personal data registered by operators, verifiers and independent persons in the CBAM registry or otherwise process those data, where authorisation in that respect was granted by the operators in accordance with Article 10(7).’
;
(13)
in Article 23(1), the following subparagraph is added:
‘The date of registration of the personal data referred to in the first subparagraph shall be the earliest of the following dates:
(a)
the competent authority refuses to grant the status of authorised CBAM declarant;
(b)
the status of authorised CBAM declarant is revoked;
(c)
an operator, verifier, independent person or the person delegated to act on behalf of and in the name of those persons was deregistered from the CBAM registry.’.