Commission Implementing Regulation (EU) 2023/1773 of 17 August 2023 laying down the rules for the application of Regulation (EU) 2023/956 of the European Parliament and of the Council as regards reporting obligations for the purposes of the carbon border adjustment mechanism during the transitional period (Text with EEA relevance)

This Regulation lays down rules for reporting obligations laid down in Article 35 of Regulation (EU) 2023/956 in respect of goods listed in Annex I to that Regulation imported into the customs territory of the Union during the transitional period from 1 October 2023 to 31 December 2025 (‘transitional period’).

For the purposes of this Regulation, the following definitions apply: (1) ‘reporting declarant’ means any of the following persons: (a) the importer who lodges a customs declaration for release for free circulation of goods in its own name and on its own behalf; (b) the person, holding an authorisation to lodge a customs declaration referred to in Article 182(1) of Regulation (EU) No 952/2013 of the European Parliament and of the Council , who declares the importation of goods; (c) the indirect customs representative, where the customs declaration is lodged by the indirect customs representative appointed in accordance with Article 18 of Regulation (EU) No 952/2013, when the importer is established outside the Union or where the indirect customs representative has agreed to the reporting obligations in accordance with Article 32 of Regulation (EU) 2023/956; (2) ‘rebate’ means any amount that reduces the amount due or paid by a person liable for the payment of a carbon price, before its payment or after, in a monetary form or in any other form.

1 Each reporting declarant shall provide, based on the data, that the operator may communicate, as provided in Annex III to this Regulation, the following information regarding goods listed in Annex I to Regulation (EU) 2023/956 imported during the quarter to which the CBAM report relates: (a) the quantity of the goods imported, expressed in megawatt hours for electricity and in tonnes for other goods; (b) the type of goods as identified by their CN code.

2 Each reporting declarant shall provide the following information regarding the embedded emissions of the goods listed in Annex I to Regulation (EU) 2023/956, as listed in Annex I to this Regulation, in the CBAM reports: (a) the country of origin of the imported goods; (b) the installation where the goods were produced, identified by the following data: (1) the applicable United Nations Code for Trade and Transport Location (UN/LOCODE) of the location; (2) the company name of the installation, the address of the installation and its English transcript; (3) geographical coordinates of the main emission source of the installation; (c) the production routes used, defined in Section 3 of Annex II to this Regulation, which shall reflect the technology used for the production of the goods, and information on specific parameters qualifying the indicated production route chosen as defined in Section 2 of Annex IV, for determining the embedded direct emissions; (d) the specific embedded direct emissions of the goods, which shall be determined by converting the attributed direct emissions of the production processes into emissions specific of the goods expressed as CO2e per tonne in accordance with Sections F and G of Annex III to this Regulation; (e) the reporting requirements that have an effect on the embedded emissions of the goods as referred to in Section 2 of Annex IV to this Regulation; (f) for electricity as imported goods, the reporting declarant shall report the following information: (1) the emission factor used for electricity, expressed as tonne CO2e per MWh (megawatt hour) as determined in accordance with Section D of Annex III to this Regulation; (2) the data source or method used for determining the emission factor of electricity as determined in accordance with Section D of Annex III to this Regulation; (g) for steel goods, the identification number of the specific steel mill where a particular batch of raw materials was produced, where known.

3 For specific embedded indirect emissions, each reporting declarant shall report the following information, as listed in Annex I to this Regulation, in the CBAM reports: (a) electricity consumption, expressed in megawatt hours, of the production process per tonne of goods produced; (b) specify whether the declarant reports actual emissions or default values made available and published by the Commission for the transitional period in accordance with Section D of Annex III to this Regulation; (c) the corresponding emissions factor of the electricity consumed; (d) the amount of specific embedded indirect emissions, which shall be determined by converting the attributed embedded indirect emissions of the production processes into indirect emissions specific of the goods expressed as CO2e per tonne in accordance with Sections F and G of Annex III to this Regulation.

4 Where the rules for determining data are different from the ones indicated in Annex III to this Regulation, the reporting declarant shall provide additional information and description on the methodological basis of the rules used to determine the embedded emissions. The rules described shall lead to similar coverage and accuracy of emissions data, including systems boundaries, production processes monitored, emission factors and other methods employed for the calculations and reporting.

5 For the purposes of reporting, the reporting declarant may request that the operator uses an electronic template provided by the Commission and provide the content of the communication in Sections 1 and 2 of Annex IV.

1 For the purpose of Article 3(2), the specific embedded emissions of goods produced in an installation shall be determined using one of the following methods, which are based on the choice of monitoring methodology determined in accordance with point B.2 of Annex III to this Regulation, consisting of either: (a) determining emissions from source streams on the basis of activity data obtained by means of measurement systems and calculation factors from laboratory analyses or standard values; (b) determining emissions from emission sources by means of continuous measurement of the concentration of the relevant greenhouse gas in the flue gas and of the flue gas flow.

2 By way of derogation from paragraph 1, until 31 December 2024, the specific embedded emissions of goods produced in an installation may be determined using one of the following monitoring and reporting methods, if they lead to similar coverage and accuracy of emissions data compared to the methods listed in that paragraph: (a) a carbon pricing scheme where the installation is located; or (b) a compulsory emission monitoring scheme where the installation is located; or (c) an emission monitoring scheme at the installation which can include verification by an accredited verifier.

3 By way of derogation from paragraphs 1 and 2, until 31 July 2024 for each import of goods for which the reporting declarant does not have all the information listed in Article 3(2) and (3), the reporting declarant may use other methods for determining the emissions, including default values made available and published by the Commission for the transitional period or any other default values as specified in Annex III. In such cases, the reporting declarant shall indicate and reference in the CBAM reports the methodology followed for establishing such values.

By way of derogation from Article 4, up to 20 % of the total embedded emissions of complex goods may be based on estimations made available by the operators of the installations.

1 For goods placed under inward processing and subsequently released for free circulation either as the same goods or as processed products, the reporting declarant shall submit in the CBAM reports, for the quarter following the quarter where the discharge from customs procedure occurred in accordance with Article 257 of Regulation (EU) No 952/2013, the following information: (a) the quantities of goods listed in Annex I to Regulation (EU) 2023/956 that have been released for free circulation following inward processing during that period; (b) embedded emissions corresponding to those quantities of goods referred to in point (a) that have been released for free circulation following inward processing during that period; (c) the country of origin of the goods referred to in point (a), where known; (d) the installations where the goods referred to in point (a) were produced, where known; (e) the quantities of goods listed in Annex I to Regulation (EU) 2023/956 placed under inward processing that resulted in processed products that have been released for free circulation during that period; (f) embedded emissions corresponding to the goods that have been used to produce the quantities of processed products referred to in point (e); (g) in case of waiver for the bill of discharge granted by customs in accordance with Article 175 of Commission Delegated Regulation (EU) 2015/2446 the reporting declarant shall submit the waiver.

2 The reporting and calculation of the embedded emissions referred to in paragraph 1 points (b) and (f) shall be done in accordance with Articles 3, 4 and 5.

3 By way of derogation from paragraph 2, when processed products or goods placed under the inward processing are released for free circulation in accordance with Article 170(1) of Delegated Regulation (EU) 2015/2446, the embedded emissions referred to in paragraph 1 points (b) and (f) shall be calculated on the basis of the weighted average embedded emissions of the totality of the goods of the same CBAM goods category as defined in Annex II to this Regulation placed under the inward processing procedure from 1 October 2023. The embedded emissions referred to in the first subparagraph shall be calculated as follows: (a) the embedded emissions of paragraph 2, point (b), shall be the total embedded emissions of the goods placed under inward processing that are imported; and (b) the embedded emissions of paragraph 2, point (f), shall be the total embedded emissions of the goods placed under inward processing that were used in one or more processing operations multiplied by the percentage quantities of the processed products obtained therefrom that are imported.

1 Where applicable, the reporting declarant shall provide in the CBAM reports the following information regarding the carbon price due in a country of origin for the embedded emissions: (a) the type of product indicated by CN code; (b) the type of carbon price; (c) the country, where a carbon price is due; (d) form of rebate or any other form of compensation available in that country that would have resulted in a reduction of that carbon price; (e) the amount of the carbon price due, a description of the carbon pricing instrument and possible compensation mechanisms; (f) indication of the provision of the legal act providing for the carbon price, rebate, or other forms of relevant compensation, including a copy of the legal act; (g) the quantity of embedded direct or indirect emissions covered; (h) the quantity of embedded emissions covered by any rebate or other form of compensation, including free allocations, if applicable.

2 The monetary amounts referred to in paragraph 1 point (e), will be converted into euro based on the average exchange rates of the year preceding to the year when the report is due. The yearly average exchange rates shall be based on quotations published by the European Central Bank. For currencies for which a quotation is not published by the European Central Bank, the yearly average exchange rates shall be based on publicly available information about the effective exchange rates. The yearly average exchange rates shall be provided by the Commission in the CBAM Transitional Registry.

1 For each quarter from 1 October 2023 until 31 December 2025 the reporting declarant shall submit the CBAM reports to the CBAM Transitional Registry no later than one month after the end of that quarter.

2 In the CBAM Transitional Registry the reporting declarant shall provide information and indicate, whether: (a) the CBAM report is submitted by an importer in its own name and on its own behalf; (b) the CBAM report is submitted by an indirect customs representative on behalf of an importer.

3 Where an indirect customs representative does not agree to carry out reporting obligations of the importer under this Regulation, the indirect customs representative shall notify the importer of the obligation to comply with this Regulation. The notification shall include the information referred to in Article 33(1) of Regulation (EU) 2023/956.

4 The CBAM reports shall include the information in Annex I to this Regulation.

5 The CBAM report, once submitted in the CBAM Transitional Registry, shall be allocated a unique Report ID.

1 A reporting declarant may modify a submitted CBAM report until two months after the end of the relevant reporting quarter.

2 By way of derogation from paragraph 1, a reporting declarant may modify the CBAM reports for the first two reporting periods until the submission deadline for the third CBAM report.

3 Upon a justified request of the reporting declarant, the competent authority shall assess that request and where appropriate shall allow the reporting declarant to resubmit a CBAM report or to correct it after the deadline referred to in paragraphs 1 and 2 and within one year after the end of the relevant reporting quarter. The resubmission of the corrected CBAM report or the correction, as applicable, shall be made no later than a month following the approval by the competent authority.

4 The competent authorities shall motivate the refusal of the request provided in paragraph 3 and inform the reporting declarant on the rights to appeal.

5 A CBAM report pending a dispute may not be modified. It can be replaced to take into account the outcome of that dispute.

1 The CBAM Transitional Registry shall be a standardised and secure electronic database containing common data elements for reporting during the transitional period, and for providing access, case handling and confidentiality.

2 The CBAM Transitional Registry shall enable communication, checks and information exchange between the Commission, the competent authorities, customs authorities, and reporting declarants in accordance with Chapter V.

1 The Commission may check CBAM reports to assess compliance with the reporting obligations of reporting declarants within the transitional period and until three months after the last CBAM report should have been submitted.

2 The Commission shall use the CBAM Transitional Registry, and the information contained in that Registry to perform the tasks laid down in this Regulation and in Regulation (EU) 2023/956.

1 For indicative purposes, the Commission shall communicate to the Member States a list of reporting declarants established in the Member State for which the Commission has reasons to believe they have failed to comply with the obligation to submit a CBAM report.

2 Where the Commission considers that a CBAM report does not contain all the information required in Articles 3 to 7 or considers a report incomplete or incorrect in accordance with Article 13, the Commission shall communicate the indicative assessment regarding that CBAM report to the competent authority in the Member State where the reporting declarant is established.

1 A CBAM report shall be considered incomplete where the reporting declarant has failed to report in accordance with Annex I to this Regulation.

2 A CBAM report shall be considered incorrect in any of the following cases: (a) the data or information in the submitted report do not comply with the requirements laid down in Articles 3 to 7 and Annex III to this Regulation; (b) the reporting declarant has submitted wrongful data and information; (c) where the reporting declarant does not provide an adequate justification for the use of reporting rules other than those listed in Annex III to this Regulation.

1 The competent authority of the Member State of establishment of the reporting declarant shall initiate the review and assess the data, information, list of reporting declarants communicated by the Commission and indicative assessment as referred to in Article 12 within three months from the communication of that list or indicative assessment.

2 The competent authorities shall use the CBAM Transitional Registry, and the information contained in that Registry, to perform the tasks laid down in this Regulation and Regulation (EU) 2023/956.

3 Within the transitional period or thereafter, the competent authorities may initiate the correction procedure regarding any of the following: (a) incomplete or incorrect CBAM reports; (b) failure to submit a CBAM report.

4 Where the competent authority initiates the correction procedure, the reporting declarant shall be notified that the report is under review, and that additional information is required. The request for additional information by the competent authority shall include the information required in Articles 3 to 7. The reporting declarant shall submit the additional information through the CBAM Transitional Registry.

5 The competent authority, or any other authority appointed by the competent authroity, shall grant the authorisation to access the CBAM Transitional Registry and manage the registration at national level taking into consideration the EORI number in accordance with the technical arrangement set out in Article 20.

1 All decisions of the competent authorities and information acquired by the competent authority in the course of performing its duty related to reporting under this Regulation, which is confidential, or which is provided on a confidential basis shall be covered by the obligation of professional secrecy. Such information shall not be disclosed by the competent authority without the express permission of the person or authority that provided it. By way of derogation from the first subparagraph, such information may be disclosed without permission where this Regulation provides for it and where the competent authority is obliged or authorised to disclose it by virtue of Union or national law.

2 Competent authorities may communicate confidential information referred to in paragraph 1 to customs authorities of the Union.

3 Any disclosure or communication of information as referred to in paragraphs 1 and 2 shall be made in compliance with applicable data protection provisions.

1 Member States shall apply penalties in the following cases: (a) where the reporting declarant has not taken the necessary steps to comply with the obligation to submit a CBAM report; or (b) where the CBAM report is incorrect or incomplete in accordance with Article 13, and the reporting declarant has not taken the necessary steps to correct the CBAM report where the competent authority initiated the correction procedure in accordance with Article 14(4).

2 The amount of the penalty shall be between EUR 10 and EUR 50 per tonne of unreported emissions. The penalty shall increase in accordance with the European index of consumer prices.

3 When determining the actual amount of a penalty, for the unreported emissions calculated on the basis of the default values made available and published by the Commission for the transitional period, the competent authorities shall consider the following factors: (a) the extent of unreported information; (b) the unreported quantities of imported goods and the unreported emissions relating to those goods; (c) the readiness of the reporting declarant to comply with requests for information or to correct the CBAM report; (d) the intentional or negligent behaviour of the reporting declarant; (e) the past behaviour of the reporting declarant as regards compliance with the reporting obligations; (f) the level of cooperation of the reporting declarant to bring the infringement to an end; (g) whether the reporting declarant has voluntarily taken measures to ensure that similar infringements cannot be committed in the future.

4 Higher penalties shall be applied when more than two incomplete or incorrect reports within the meaning of Article 13 have been submitted in a row or the duration of the failure to report exceeds 6 months.

1 The CBAM Transitional Registry shall be interoperable with: (a) the Uniform User Management and Digital Signature (UUM&DS) system for the purposes of users registration and access management for the Commission, Member States, and reporting declarants, as referred to in Article 16 of Implementing Regulation (EU) 2023/1070; (b) the Economic Operator Registration and Identification (EORI) for the purpose of validating and retrieving the Economic Operator Identity Information, as referred to in Article 30 of Implementing Regulation (EU) 2023/1070, for the data laid out Annex V to this Regulation; (c) the Surveillance system for the purpose of retrieving information on Customs Imports Declarations for goods listed in Annex I to Regulation (EU) 2023/956 for checks of the CBAM reports and compliance, developed through the UCC Surveillance 3 (SURV3), as referred to in Article 99 of Implementing Regulation (EU) 2023/1070; (d) the TARIC System as referred to in Regulation (EEC) No 2658/87.

2 The CBAM Transitional Registry shall be interoperable with decentralised systems as developed or upgraded through the Implementing Decision (EU) 2019/2151, for the purpose of retrieving information on Customs Imports Declarations for goods listed in Annex I to Regulation (EU) 2023/956, as specified in Annex VI and Annex VII to this Regulation, and for checking the CBAM reports and ensuring compliance of the reporting declarants when that information is not available in the SURV3 system.

The Commission and Member States shall designate contact points for each of the electronic systems referred to in Article 17 of this Regulation, for the purposes of exchanging information to ensure a coordinated development, operation, and maintenance of those electronic systems. The Commission and Member States shall communicate the details of these contact points to each other and inform each other immediately of any changes to those details.

The CBAM Transitional Registry shall consist of the following common components (‘common components’): (a) the CBAM Trader Portal (CBAM TP); (b) the CBAM Competent Authorities Portal (CBAM CAP) with two segregated spaces: (1) one for the National Competent Authorities (CBAM CAP/N); and (2) another for the Commission (CBAM CAP/C); (c) the CBAM User Access Management; (d) the CBAM Registry Back End Services (CBAM BE); (e) the public CBAM page on the Europa website.

1 The Commission shall propose the Terms of Collaboration, Service Level Agreement, and security Plan, for agreement with the competent authorities. The Commission shall operate the CBAM Transitional Registry in compliance with the terms agreed.

2 The CBAM Transitional Registry shall be used with respect to the CBAM reports and to the Import Declarations Records to which these reports relate.

1 The authentication and access verification of the reporting declarant for the goods listed in Annex I to Regulation (EU) 2023/956, for the purposes of access to the components of the CBAM Registry shall be done using the UUM&DS system as referred to in Article 17(1), point (a).

2 The Commission shall provide the authentication services allowing the users of the CBAM Transitional Registry to securely access that Registry.

3 The Commission shall use UUM&DS to grant the authorisation to access the CBAM Transitional Registry to its staff and to provide the delegations to the competent authorities to issue their authorisations.

4 The competent authorities shall use UUM&DS to grant the authorisation to access the CBAM Transitional Registry to their staff and to the reporting declarants established in their Member State.

5 A competent authority may opt to use an identity and access management system set up in their Member State pursuant to Article 26 of this Regulation (national Customs eIDAS system) to provide the necessary credentials to access the CBAM Transitional Registry.

1 The CBAM Trader Portal shall be the unique entry point to the CBAM Transitional Registry for the reporting declarants. The portal shall be accessible from the internet.

2 The CBAM Trader Portal shall interoperate with the CBAM Registry Back End services.

3 The CBAM Trader Portal shall be used by the reporting declarant for: (a) the submission of the CBAM reports via a web interface or a System-to-System interface; and (b) receiving notifications related to their CBAM compliance obligations.

4 The CBAM Trader Portal shall offer facilities for the reporting declarants to store the information about third countries installations and embedded emissions for their later re-use.

5 The access to the CBAM Trader Portal shall be exclusively managed by the CBAM Access Management referred to in Article 26.

1 The CBAM Competent Authorities Portal for the National Competent Authorities shall be the unique entry point to the CBAM Transitional Registry for the competent authorities. The portal shall be accessible from the internet.

2 The CBAM Competent Authorities Portal for the National Competent authorities shall interoperate with the CBAM Registry Back End services via the internal network of the Commission.

3 The CBAM Competent Authorities Portal for the National Competent Authorities shall be used by the competent authorities to carry out the tasks laid down in this Regulation and in Regulation (EU) 2023/956.

4 The access to the CBAM Competent Authorities Portal for the National Competent Authorities shall be exclusively managed by the CBAM Access Management referred to in Article 26.

1 The CBAM Competent Authorities Portal for the Commission shall be the unique entry point to the CBAM Transitional Registry for the Commission. The portal shall be accessible on the Commission internal network and the internet.

2 The CBAM Competent Authorities Portal for the Commission shall interoperate with the CBAM Registry Back End services over the internal network of the Commission.

3 The CBAM Competent Authorities Portal for the Commission shall be used by the Commission to perform the tasks laid down in this Regulation and in Regulation (EU) 2023/956.

4 The access to the CBAM Competent Authorities Portal for the Commission shall be exclusively managed by the CBAM Access Management referred to in Article 26.

1 The CBAM Registry Back End Services shall serve all requests placed by: (a) the reporting declarants via the CBAM Trader Portal; (b) the competent authorities via the CBAM Competent Authority Portal/N; (c) the Commission via the CBAM Competent Authority Portal/C.

2 The CBAM Registry Back End Services shall store centrally and manage all the information entrusted to the CBAM Transitional Registry. It shall guarantee their persistence, integrity, and coherence of that information.

3 The CBAM Registry Back End Services shall be managed by the Commission.

4 The access to the CBAM Registry Back End Services shall be exclusively managed by the CBAM Access Management referred to in Article 26.

The Commission shall set up the access management system to validate the access requests submitted by reporting declarants and other persons within the UUM&DS system as referred to in Article 17(1), point (a) by connecting the Member States’ identity and the EU identity and access management systems pursuant to Article 27.

The Commission shall set up the administration management system to manage the authentication and authorisation, the identification data of reporting declarants and other persons for the purposes of allowing access to the electronic systems.

The Member States shall set up or use existing an identity and access management systems to ensure: (a) a secure registration and storage of identification data of reporting declarants and other persons; (b) a secure exchange of signed and encrypted identification data of reporting declarants and other persons.

1 The CBAM Transitional Registry common components shall be developed, tested, deployed, and managed by the Commission, and may be tested by the Member States. The competent authority of the Member State of establishment of the reporting declarant shall communicate the decisions on penalties with the respective outcome of that process to the Commission, by electronic systems developed at national level, linked to enforcement and penalties, or by other means.

2 The Commission shall design and maintain the common specifications of the interfaces with components of electronic systems developed at national level in close cooperation with the Member States.

3 Where appropriate, common technical specifications shall be defined by the Commission in close cooperation with, and subject to review by the Member States, with a view to deploying them in due time. The Member States and, where appropriate, the Commission shall engage in the development and deployment of the systems. The Commission and the Member States shall also collaborate with reporting declarants and other stakeholders.

1 The Commission shall perform the maintenance of the common components and the Member States shall perform the maintenance of their national components.

2 The Commission shall ensure uninterrupted operation of the electronic systems.

3 The Commission may change the common components of the electronic systems to correct malfunctions, to add new functionalities or to alter existing ones.

4 The Commission shall inform the Member States of changes and updates to the common components.

5 The Commission shall make the information on the changes and updates to the electronic systems set out in paragraphs 3 and 4 publicly available.

1 In the event of a temporary failure of the CBAM Transitional Registry, reporting declarants and other persons shall submit the information required to fulfil the required formalities by the means determined by the Commission, including by means other than electronic data-processing techniques.

2 The Commission shall inform Member States and reporting declarants about any unavailability of the electronic systems resulting from a temporary failure.

3 The Commission shall prepare a CBAM business continuity plan to be agreed between the Member States and the Commission. In case of temporary failure of the CBAM Transitional Registry, the Commission shall evaluate the conditions to activate it.

The Commission shall support the Member States on the use and functioning of the common components of the electronic systems by providing the appropriate training material.

1 The personal data registered in the CBAM Transitional Registry, and the components of electronic systems developed at national level shall be processed for the purposes of implementing the Regulation (EU) 2023/956 having regard to the specific objectives of those databases as set out in this Regulation. The purposes for which the personal data could be processed shall be the following: (a) authentication purposes and access management; (b) monitoring, checks and review of CBAM reports; (c) communication and notifications; (d) compliance and judicial proceedings; (e) functioning of the IT infrastructure, including interoperability with decentralised systems under this Regulation; (f) statistics and review of the functioning of Regulation (EU) 2023/956 and this Regulation.

2 The Member States’ national supervisory authorities in the field of personal data protection and the European Data Protection Supervisor shall cooperate, in accordance with Article 62 of Regulation (EU) 2018/1725, to ensure coordinated supervision of the processing of personal data registered in the CBAM Transitional Registry and the components of electronic systems developed at national level.

3 The provisions contained in this Article shall be without prejudice to the right to rectification of personal data in accordance with Article 16 of Regulation (EU) 2016/679.

1 The data registered in the CBAM Transitional Registry by a reporting declarant may be accessed or otherwise processed by that reporting declarant. It may also be accessed and otherwise processed by the Commission and competent authorities.

2 Where incidents and problems in the operational processes are identified in the provision of the services of the systems where the Commission act as a processor, the Commission may have access to the data in these processes only for the purpose of resolving a registered incident or problem. The Commission shall ensure the confidentiality of such data.

The Commission shall be the system owner of the CBAM Transitional Registry.

1 The Commission shall ensure the security of the CBAM Transitional Registry.

2 For those purposes, the Commission and Member States shall take the necessary measures to: (a) prevent any unauthorised person from having access to installations used for the processing of data; (b) prevent the entry of data and any consultation, modification, or deletion of data by unauthorised persons; (c) detect any of the activities referred to in points (a) and (b).

3 The Commission and the Member States shall inform each other of any activities that might result in a breach or a suspected breach of the security of the CBAM Transitional Registry.

4 The Commission and the Member States shall establish security plans concerning the CBAM Transitional Registry.

For the CBAM Transitional Registry and in relation to the processing of personal data, the Commission and Member States shall act as joint controllers as defined in Article 4, point (7), of Regulation (EU) 2016/679 and as defined in Article 3, point (8) of Regulation (EU) 2018/1725.

1 In order to achieve the objectives pursued under this Regulation and Regulation (EU) 2023/956, in particular Article 30 thereof, the data retention period for the data in the CBAM Transitional Registry shall be limited to 5 years from the reception of the CBAM report.

2 Notwithstanding paragraph 1, where an appeal has been lodged or where court proceedings have begun involving data stored in the CBAM Transitional Registry, those data shall be retained until the appeal procedure or court proceedings are terminated and shall only be used for the purpose of the aforementioned appeal procedure or court proceedings.

The Commission and the Member States shall conduct assessments of the components they are responsible for and shall, in particular, analyse the security and integrity of those components and the confidentiality of the data processed within those components. The Commission and the Member States shall inform each other of the results of those assessments.

This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union.