CBAM & CSDDD: What the EU's Supply-Chain Rules Actually Ask of a China Importer
Two EU regimes get mentioned in the same breath so often that importers assume they're one thing. They aren't. CBAM is a carbon price. CSDDD is a due-diligence obligation. They apply to different categories of business, on different logic, and they ask a Chinese supplier for different kinds of information. Confusing them tends to mean an importer either dismisses both as irrelevant, or panics about a scope that doesn't actually cover their product.
This guide separates the two, explains what each is actually trying to do, and sets out the practical burden on a business sourcing from China — most of which is a data problem with your supplier, not a legal problem for you. It closes with what to start doing now, regardless of which regime currently applies to your business.
One note before the detail: this is practitioner orientation, not legal advice. Both regimes have been amended, delayed and simplified since they were first adopted, and both are likely to move again. If either genuinely applies to your business, get specialist compliance advice rather than working from a guide.
1. Two different problems, wearing similar acronyms
CBAM — the Carbon Border Adjustment Mechanism — is about carbon. It exists because EU producers of certain materials pay a carbon price under the EU's internal emissions trading system, and imports of the same materials from countries without an equivalent carbon price would otherwise undercut them on that basis alone. CBAM closes that gap by pricing the embedded carbon in imported goods to roughly match what an EU producer would have paid.
CSDDD — the Corporate Sustainability Due Diligence Directive — is about conduct, not carbon. It requires large companies to identify, prevent and address human rights and environmental harms across their chain of activities, and to be able to show they did so.
The two share a premise — that a product's EU compliance status depends on facts about its production, not just its own characteristics at the border — but they ask for different evidence, apply to different companies, and sit in different parts of an importer's paperwork. Treat them separately.
2. CBAM: what it actually is
CBAM is narrower than its reputation suggests. It does not tax imports in general, and it is not aimed at consumer goods as a category. It applies to specific carbon-intensive input categories: iron and steel, aluminium, cement, fertilisers, electricity and hydrogen. If your product isn't made from or doesn't contain material from one of those categories, CBAM has no direct claim on it.
The mechanism, in outline: an importer of covered goods needs to account for the greenhouse gas emissions embedded in producing them, and effectively pay the difference between the carbon cost already borne in the country of production and the carbon cost an equivalent EU producer bears under the EU's internal system. China's producers of steel, aluminium, cement and fertilisers generally do not face an equivalent domestic carbon price, so the gap is real for goods coming from Chinese mills and smelters.
The phase-in structure, the exact list of downstream product codes it reaches, and the point at which certificate purchase becomes a live financial obligation rather than a reporting exercise have all shifted since the regulation was adopted, including simplification proposals that narrowed and delayed parts of it. Do not treat any specific date, threshold or price you've seen — including in older material of ours — as current. Confirm the position against the European Commission's own CBAM guidance for the product codes you actually import.
3. Why a finished product can be exempt while its steel isn't
The category list looks like it describes raw commodities, but CBAM reaches downstream products built from them — a defined, and periodically revised, list of processed goods under those headings: certain steel and aluminium articles, some fabricated components, specific fertiliser blends. This is where importers get caught out.
A piece of furniture with a powder-coated steel frame, an aluminium extrusion used as a bracket or housing, a fabricated steel fitting inside an otherwise unremarkable finished product — these can bring a component into CBAM's scope even where the finished, assembled product as a whole sits outside it, or wouldn't obviously read as a "steel" or "aluminium" good to anyone looking at the packaging. The practical implication is that you cannot screen your catalogue by asking "do I import steel or aluminium products" — you need to ask it at the bill-of-materials level, component by component, for anything with a metal, cement or fertiliser content sourced from China.
4. The real burden is embedded-emissions data, and most suppliers don't have it
Once you've identified a covered input, the obligation that actually lands on you is data collection, not a payment calculation you can do yourself. CBAM asks for the embedded emissions of the specific goods — energy consumption per unit of output, the emissions factor of the energy source, process emissions specific to the production route — attributable to the actual installation that made them, not an industry average, where that data is available.
This is the part that stalls most importers. A mid-size Chinese factory making steel brackets or aluminium fittings is very unlikely to have this data assembled in a form that matches what CBAM reporting expects, and is very unlikely to have been asked for it before. Your factory's answer to a first request is often silence, or a generic factory-wide energy figure that doesn't map to your specific order. Where actual, verified data genuinely isn't obtainable, default values exist as a fallback within the regime's methodology — but a fallback figure is generally less favourable than accurate supplier data, and the methodology for using default values has itself changed as the regime has been simplified, so don't assume a specific default applies to your product without checking.
What to ask a supplier for, concretely: which specific production route made your goods (this changes the emissions factor materially — electric-arc-furnace steel and blast-furnace steel are not interchangeable for this purpose); their energy mix and consumption per tonne or unit for the relevant process; and whether they, or their own upstream smelter or mill, have any existing emissions reporting — some larger Chinese producers already report for other markets or their own compliance regimes and can supply usable figures faster than a smaller mill starting from nothing. Start this conversation with a supplier now, on ordinary orders, rather than when a shipment is waiting on a declaration.
5. CSDDD: due diligence across the "chain of activities"
CSDDD applies to large companies — defined by turnover and, in some versions of the rules, headcount, with thresholds that have been revised, raised and phased more than once since adoption, so treat any specific number as unconfirmed until you check the current text. Companies within scope must carry out due diligence covering their "chain of activities": their own operations, their subsidiaries, and their business partners — which reaches upstream suppliers directly, and downstream distribution and use in some circumstances.
For an EU company in scope that sources from China, this means identifying and addressing human rights and environmental risks in its supplier base — not just at the factory it contracts with directly, but further upstream where the directive's chain-of-activities concept reaches. That includes labour conditions, environmental harms and, notably, the kind of forced-labour exposure covered in our UFLPA guide — a different statute, different jurisdiction, same underlying question about who actually made your inputs and under what conditions.
6. Why this can reach you even if you're not in scope
Here is the effect that catches mid-size importers who've correctly concluded CSDDD doesn't apply to them directly. CSDDD-scoped companies are required to look at their own business partners as part of their chain of activities — and a mid-size importer selling components, private-label goods or white-label product into a large EU retailer or brand is exactly that kind of business partner.
In practice, this arrives as a request rather than a regulation: a supplier questionnaire, a code-of-conduct sign-off, a demand for audit reports and factory information going beyond anything your customer asked for two years ago. You may never be named in CSDDD text, and the obligation in law sits entirely with your customer — but the paperwork obligation, functionally, sits with you, because your customer cannot complete their own due diligence without what you can tell them about your supply chain. Losing the account for failing to answer is a commercial consequence, not a legal one, but it's the one that actually bites for most businesses this size.
7. Where this connects to work you may already be doing
If you already commission factory audits, you are closer to CSDDD-readiness than you might think — but a standard social-compliance audit and a CSDDD-aligned due-diligence file are not the same document. An audit tells you about conditions at one facility on one day. What a CSDDD-scoped customer increasingly wants is a written programme: a policy, a supplier code of conduct, evidence you assess risk across your supplier base, and a record of what you did when something came up short. Our factory audit service can be scoped to produce evidence that feeds into that kind of file, rather than a standalone report that sits in a drawer.
There's real overlap with forced-labour due diligence too. The upstream-tracing habits described in our UFLPA guide — knowing who supplies your supplier, keeping documentation before anything goes wrong — are close to what CSDDD due diligence and CBAM emissions requests both ask for as well: material origin, tier-2 identity, paper trail. Build that once and it serves more than one regime.
8. What to start doing now, regardless of current scope
You don't need to wait for certainty about thresholds and deadlines that are still moving to start the groundwork. Four things are worth doing whether or not you currently sit inside either regime:
- Know your material inputs at the component level. Not "we sell furniture" but "the frame is steel, the fixings are zinc-plated steel, the packaging strapping is polypropylene." You cannot answer a CBAM or CSDDD question about a material you haven't identified.
- Know who's behind your tier-1 supplier, at least for metal, cement and fertiliser inputs. Ask your factory who casts, extrudes or mills the material before it reaches them. This is the same question forced-labour tracing asks, and the answer serves both purposes.
- Keep documentation as you go, not retrospectively. Supplier correspondence on energy sources and production routes, any emissions figures a mill can offer, audit reports, code-of-conduct sign-offs — filed per product, dated, so a request finds a package rather than starting one from nothing.
- Write information rights into your contracts. A clause obliging your supplier to disclose upstream sourcing, energy and emissions information on request, and to flow the same obligation down their own supply chain, costs nothing to add and is very hard to retrofit once a relationship is running. See our purchase order essentials guide for how these clauses sit alongside the rest of a working PO.
None of this requires you to resolve which threshold, date or product code currently applies — that's exactly the kind of detail that keeps moving, and chasing every revision yourself is a poor use of time next to just having the underlying information ready.
9. What we don't know, and where the honest limits are
Be clear-eyed about what this guide can and can't tell you. Both CBAM and CSDDD have been amended since adoption, including proposals that simplified, narrowed or delayed parts of each — and further changes are plausible before either regime is genuinely settled. Any specific deadline, reporting frequency, turnover threshold, employee count, penalty figure or carbon price you encounter, in this guide or elsewhere, should be treated as a snapshot that needs confirming against current European Commission and EU official guidance for your actual product codes and your actual company size, not as a fact to build a compliance programme on unverified.
If either regime plausibly applies to your business — because you import CBAM-covered categories in meaningful volume, or because a large EU customer is asking you to evidence your supply chain — that's the point to bring in specialist compliance or trade counsel, not to keep working from general guidance. What we can help with is the sourcing side: getting the supplier data, the tracing documentation and the audit scope in place so that whoever advises you on the legal position isn't starting from zero.
If you'd like help getting emissions or upstream-material information out of a Chinese supplier, or scoping an audit to produce documentation a due-diligence file can actually use, get a quote — or start with a free supplier check.
Related: UFLPA & forced-labour compliance · European importers guide · Factory audit checklist · Purchase order essentials