CUSTOMS POLICY

Regulation (EU) 2026/2108

The new Union Customs Code and theEuropean Union Customs Authority

Analysisof the Official Journal text: what is new, timetable, secondary legislation andthe role of artificial intelligence

Based on the text published in OJ L of 19 September 2026

Prepared on 19 September 2026

CONFIDENTIAL.FOR INTERNAL USE.

This note is a working analysis and does not constitute legaladvice. Article references are to Regulation (EU) 2026/2108 unless statedotherwise. Where the note gives its own reading of an ambiguous provision, thisis flagged.

Contents

1 Executive summary

2 Adoption, structure and legalarchitecture

3 What is new

4 Timetable

5 Secondary legislation: delegated andimplementing acts

6 Artificial intelligence: where it helpsauthorities and compliant trade

7 Points for immediate attention

A Annex A: Inventory of delegated andimplementing empowerments by category

1. Executive summary

Regulation (EU) 2026/2108 of 16 September 2026, published today, repealsRegulation (EU) No 952/2013 and replaces it with a code of 287 articles and 122recitals that does two things at once. It re-writes the customs rulebook arounda single Union Customs Data Hub in which the customs declaration as a documentis progressively replaced by the provision of data by the parties in the supplychain, and it creates the European Union Customs Authority (EUCA), seated inLille, to run risk management at Union level, support the Commission and MemberStates and, where entrusted, operate the Hub. It enters into force on 20September 2026 and applies generally from 21 September 2027, but with threequite different clocks running behind that headline date.

The first clock is the e-commerce track. The Union Handling Fee, theimporter for distance sales, the customs warehouse for distance sales and thevaluation rules for distance sales are the earliest operational changes. Thestatutory sequence is a first delegated act on the fee by 29 September 2026with a 30-day scrutiny period, application of the fee 10 days after that actenters into force, and Hub-based data provision for distance sales and the IOSSscheme from 1 July 2028. On the statutory path, and on my computation, the feecould therefore start to apply in early-to-mid November 2026, well before theRegulation applies generally. Nobody with distance-sales exposure should assumethat 21 September 2027 is the relevant date.

The second clock is institutional. The provisions establishing the EUCAand the Data Hub apply from entry into force, the Executive Board must be inplace by 21 September 2029 and the Commission runs risk-management tasks forthe EUCA until 30 June 2028. The Customs Advisory Board, which is the naturalchannel for trade input, has its composition determined by the ManagementBoard, and the Regulation offers no guaranteed sector seats. That is a designpoint that deserves early attention.

The third clock is the general transition to data provision. Customsdeclarations continue to apply for importers other than distance-salesimporters, and for exporters and transit holders, until 28 February 2031.Voluntary use of the Hub starts on 1 March 2031 and use becomes mandatory on 1March 2034, with legacy systems and the current simplifications permitted until28 February 2034. In substance, the classical declaration-based import andexport process lives on for some six and a half years after the Regulationapplies, and the compliance burden in the meantime shifts to status,representation, responsibility for other legislation and the quality of data.

For a broker, a representative and a carrier group the most consequentialchanges are not the Hub itself but what is attached to it. The importer becomesa defined and single responsible person who must comply with other legislationapplied by the customs authorities (Art 27(2)(c)). An indirect customsrepresentative acting for an EU-established principal becomes jointly andseverally responsible for the Art 27(2) and 28(1) obligations (Art 33(2)), andstands in the place of a non-EU principal (Art 33(3)). Release can be refusedon evidence of non-compliance with other legislation, and release is expresslynot proof of conformity (Art 77). The Trust and Check trader (Art 31) is thenew top tier, with benefits that include post-release data completion, releaseon behalf of customs from 1 July 2028 and periodic debt calculation. Only Trustand Check traders and AEO-C holders may offer representation services acrossMember States (Art 33(7)), and only IOSS-active Trust and Check traders mayoperate the new distance-sales warehouse (Art 145).

The secondary legislation programme is very large. The Regulationcontains 86 delegated-act empowerments (Art 282 governs their exercise) and 93implementing-act empowerments, spread over 17 categories (section 5 and AnnexA). Three delegated acts are mandatory: the EU Customs Data Model (Art 49),unilateral preferential origin (Art 171(9)) and the thresholds for systematicnon-compliance (Art 276(6)). In my reading the Data Model gates most of thedata-set acts elsewhere in the text, and it is the item on which the timetableof the whole Hub depends. Art 286 sets fixed deadlines for the delegated andimplementing acts needed for each Hub phase: 1 July 2027 for the acts requiredfor the 2028 distance-sales go-live, 1 March 2029 for the next phase and 31 January2033 for the last.

Artificial intelligence is not an add-on in this text. Risk analysis isdefined to include AI systems within the meaning of Regulation (EU) 2024/1689(Art 5(34)), risk management is to be primarily automated (Art 55(1)), the Hubmust support AI functionalities in accordance with the AI Act (Art 38(3)), andArt 38(4) makes clear that automation does not shift legal responsibility awayfrom the person or authority on whose behalf it acts. The opportunity is realon both sides: authorities gain from classification, valuation and originscreening and from cross-border risk signalling, and compliant trade gains fromdata-quality assurance, classification support, and evidence packs that makeTrust and Check status economically worthwhile. The constraints are equallyexplicit: the sovereignty and no-transfer rule of Art 37(6), the purposelimitation of Art 41(1), the rights to be heard and to reasons in Art 8(6)–(7),and the AI Act timetable, under which the stand-alone high-risk obligationsapply from 2 December 2027, after general application of the Code but beforethe EUCA takes over Hub risk functions on 1 July 2028. Section 6 sets outfifteen authority-side and thirteen trade-side use cases with their legalanchor and guardrail.

Two drafting observations are worth registering at once. Recital 120states that the distance-sales and EUCA provisions apply from 1 July 2028,whereas Art 287 applies many of them from entry into force or from 21 September2027; the operative text controls, but the inconsistency will generatequestions. And the Regulation contains no express grandfathering orreassessment mechanism for existing authorisations under Regulation (EU) No952/2013 other than the Art 93 sunset of certain simplifications and the continuationof existing delegated and implementing acts under Art 284. Whether existingAEO-C holders and temporary-storage authorisations carry across is therefore apoint for the implementing acts and for the Commission guidelines.

2. Adoption, structure and legal architecture

2.1Adoption

The Regulation rests on Arts 33, 114 and 207 TFEU, combining the customscooperation, internal market and common commercial policy bases, and wasadopted at second reading: the Council adopted its position at first reading on3 September 2026, the European Parliament approved that position on 16September 2026, and the act was signed at Strasbourg the same day by thePresidents of the Parliament and the Council. It was published in the OfficialJournal on 19 September 2026 and, under Art 287(1), enters into force on theday following publication, 20 September 2026.

2.2Structure

The text comprises 122 recitals, 15 Titles, 287 articles and an Annexcontaining the correlation table with Regulation (EU) No 952/2013. Thestructure is no longer the linear customs-formality sequence of the 2013 Code.It is organised around the Data Hub (Title III) and around supervision and riskmanagement (Title IV), which sit before the placing of goods, entry and exit,so that data and risk are the organising concepts and procedures follow.

Title

Articles

Subject

1–25

General provisions: scope, mission, definitions, decisions, rulings, charges and Union Handling Fee

26–34

Economic operators: registration, obligations of importers and exporters, AEO, Trust and Check trader, customs representatives

III

35–53

The Union Customs Data Hub: establishment, sovereignty, functionalities, data protection, access, retention, Data Model

54–70

Supervision, risk management and customs controls

71–96

Placing of goods under a customs procedure, release, declarations and simplifications, disposal

97–113

Entry of goods, advance cargo information, temporary storage, release for free circulation

VII

114–123

Exit of goods, export and pre-departure information

VIII

124–165

Special procedures: transit, storage, specific use, processing

166–182

Tariff classification, origin and customs value

183–224

Customs debt, guarantees, payment, repayment, remission and extinguishment

225–228

Restrictive measures and crisis management

XII

229–265

The European Union Customs Authority

XIII

266–272

Cooperation with other authorities and with third countries

XIV

273–278

Penalties

279–287

Final provisions: reporting, delegation and committee procedure, repeal, transition, entry into force

2.3Legal architecture

Three architectural features determine how the Regulation works inpractice. First, it is a Regulation with a very heavy secondary layer: thelevel-one text deliberately leaves data sets, technical procedures, thresholdsand even the amount of the Union Handling Fee to delegated and implementingacts, and Art 282 and Art 283 provide for the corresponding scrutiny andcommittee procedures. Second, the transition is built into the text itselfrather than into a separate transitional regulation, through Arts 285 and 286.Third, existing delegated and implementing acts adopted under Regulation (EU)No 952/2013 continue until repealed (Art 284), and from 1 July 2028 referencesto the customs declaration are to be read as references to data provisionthrough the Hub, and references to the declarant as references to the carrier,importer, exporter or holder as the case may be (Art 284(2)). This reading ruleis the bridge that keeps the existing secondary law functioning through thetransition, and it will be one of the more litigated provisions.

3. What is new

The following sub-sections take the innovations in the order in which atrader meets them. Where the Regulation carries forward existing law withoutmaterial change, it is not discussed. Where the working consolidated text of 30March 2026 held in the project differs, section 3.15 records the movement.

3.1Mission and vocabulary

Art 2 restates the mission of the customs authorities in wider terms thanRegulation (EU) No 952/2013. The customs authorities are to act as one, andtheir remit expressly extends beyond revenue and trade facilitation to thesafety, security, health and consumer and environmental protection dimensionsof goods crossing the border, together with other public interests. This is thetextual basis for the whole architecture of shared data withmarket-surveillance, food-safety and tax authorities, and for the duty onimporters to comply with other legislation.

The definitions in Art 5 are rebuilt around the new logic. The importeris defined through a hierarchy in Art 5(13), and only one person can be theimporter at any one time (Art 27(1)). The importer for distance sales, theperson who supplies or facilitates the distance sale, is a separate legalcategory (Art 5(14)); the exporter must be established in the Union (Art5(17)). “Other legislation applied by the customs authorities” isdefined in Art 5(3) and is the hinge for most of the new compliance duties. Therisk vocabulary in Art 5(34)–(43) is new: “risk analysis” is definedto include the use of AI systems as defined in Art 3(1) of the AI Act (Art5(34)), and “risk signal” and “risk analysis result” (Art5(35)–(36)) may be produced by an automatic process or by further humanassessment. The definitions of distance sales, the IOSS scheme, consignment anditem (Art 5(15), (16), (44) and (78)) apply already from entry into force (Art287(3)), which matters because the e-commerce provisions are keyed to them.

3.2Responsible persons, importers, exporters and representation

Title II re-centres the Code on the persons who bear responsibility.Registration (Art 26) is the entry point. Art 27 obliges the importer to complywith the customs legislation and, new in substance, with the other legislationapplied by the customs authorities (Art 27(2)(c)), to notify suspiciousmovements, and to be established in the Union subject to exceptions. Art 28mirrors this for the exporter (Art 28(1)(c)).

The customs representative regime is the most consequential change forbrokerage. Under Art 33(2) an indirect representative acting for anEU-established importer or exporter is jointly and severally responsible forthe Art 27(2) and 28(1) obligations, which on its face includes thenon-financial obligations, not only the customs debt. Under Art 33(3) anindirect representative acting for a principal who is not established in theUnion is deemed to be the importer or exporter. Art 33(7) restricts the provisionof representation services in another Member State, and the clearance ofdistance sales for free circulation, to holders of AEO-C or Trust and Checkstatus. My reading is that this restriction applies from general application on21 September 2027, but the interplay with Art 287 and with the delegated actunder Art 33(8) should be confirmed once that act is drafted. The consequencefor multinational brokers is that the compliance model has to be rebuilt on theassumption that representation carries product-compliance exposure and thatUnion-wide representation is a status-gated service.

3.3Decisions and rulings

The general rules on decisions are tightened and made time-bound. Thecompetent authority for a decision is that of the Member State of establishment(Art 6(1)(a)). Art 8(2) and (3) set a 30-day admissibility check, extendable toa maximum of 60 days where information is missing, at the end of which anapplication on which the authority has not communicated is considered accepted;a decision period of 120 days from acceptance, extendable by 30 days; and,where the authority still fails to decide, an automatic notification afterwhich the applicant may treat the failure as a negative decision. Silencetherefore makes the application admissible but never grants the authorisation.Decisions are in principle valid without limitation of time (Art 8(5)). Art 8(6)–(7)preserve the right to be heard and the duty to give reasons, which areimportant as soon as any part of the assessment is automated.

Holders of decisions must monitor their own compliance (Art 9(2)).Customs must monitor holders, keeping new operators (less than three years inoperation) under closer watch for the first year (Art 9(4)), and the EUCA mustbe notified of the relevant decisions (Art 9(5)). Binding tariff, origin andvaluation information (Art 15) is valid for three years, and Art 16 adds aCommission mechanism by which the Commission can, by implementing decision,request the revocation of a ruling that does not conform to the correctapplication of the law (Art 16(12)), and provides for a six-month extended useperiod. The ruling system therefore becomes centrally supervised rather thanonly nationally managed.

3.4AEO and the Trust and Check trader

Art 29 keeps the AEO but changes its supervision: in-depth monitoringwith an on-site visit at least every three years, no re-examination of thecriteria for simplifications for holders (Art 29(6)), and an obligation on theauthority to have a business continuity mechanism (Art 29(9)).

Art 31 introduces the Trust and Check trader, the flagship of the Code.Eligibility requires two years of regular customs operations and a three-yeardata look-back. The criteria include a real-time electronic system and accessto the Hub, and monitoring is in-depth and at least every two years. The EUCAverifies the status (Art 31(6)) and the Commission can, by implementingdecision, require the suspension or revocation of a status; suspension ismandatory in the event of fraud or of an infringement of other legislation (Art31(7)). The benefits in Art 31(8) are substantial: completion of data afterrelease (Art 74(5)), release on behalf of customs from 1 July 2028 (Art 78),performance of own controls (Art 78(3)), periodic debt calculation over amaximum of 31 days, communicated within five days (Arts 205(5) and 208(2)),deferred payment (Art 212(2)), and a transit exemption (Art 31(8)(f)). Thestatus is supervised by the Member State of establishment (Art 6(2)(b)) and thecustoms debt is incurred there (Art 193(1)(d)). A distance-sales importer canqualify as a Trust and Check trader after two years of IOSS use (Art 31(3)(g)).

The practical question for large integrators is not whetherto pursue the status but how to sequence it. The two-year operating history andthe real-time system requirement mean that the preparation window before thebenefits become operational on 1 July 2028 is already short, and the Art 31(7)suspension trigger for infringements of other legislation means that the valueof the status is tied directly to the quality of product-compliance controls,which lie outside the traditional customs control environment.

3.5The Union Customs Data Hub

Title III is the core of the reform. The Hub is a Union-levelinfrastructure that receives the data provided by economic operators, makes itavailable to customs and other authorities, hosts the risk-management functionsand interfaces with the EU Single Window Environment for Customs (CSW-CERTEX)and with other Union systems. Its establishment, pilot phase and developmentprovisions (Arts 35–39 and 51) apply from entry into force.

Art 37 is the sovereignty article. It requires infrastructure located inthe Union, suppliers controlled from the Union and free from the reach ofthird-country legislation, prohibits transfers of data processed in the Huboutside the Union (Art 37(6)) and contains anti-lock-in obligations. Combinedwith Art 41(1), which limits persons to processing Hub data only to exercisetheir rights, fulfil their obligations or demonstrate compliance, this is asharp constraint on the secondary use of the data and on the location of anyanalytical tooling.

Art 38(3) lists the required functionalities: among them AIfunctionalities operating in accordance with the AI Act, integration withCSW-CERTEX, reporting of non-compliant goods, and data portability. Art 38(4)states that automated acts remain the acts of the persons or authorities onwhose behalf they are performed, and recital 27 draws on the Euranimi case(T-81/22) for the proposition that automation does not change the legalqualification of the act. Access for tax, food-safety and market-surveillanceauthorities, OLAF and the EPPO is governed by Art 42, and for Europol andFrontex by Art 43. Retention is ten years (Art 45), data-subject rights arerestricted in defined cases (Art 47), and the Data Auditor is established underArts 246–247. The EU Customs Data Model is to be adopted by mandatory delegatedact (Art 49). Art 40 allows national applications, Art 52 provides a fall-backsolution and Art 53 Member State derogations.

The Hub is thus simultaneously a filing system for traders, a risk enginefor authorities and a shared evidence base across regulatory domains. The lastpoint is the significant one: information a trader provides for customspurposes will be visible to product-safety and tax authorities, and the reverseis not true only to the extent that Art 41 and the implementing acts under Arts42(4) and 43(8) make it so.

3.6From declaration to data

Art 74 replaces the declaration with the provision of data to the Hubbefore notification of availability of the goods. IOSS users provide data bythe day after payment, post-release completion is available to Trust and Checktraders and in justified cases, and digital copies of original documents aresufficient (Art 76). The minimum data set for release for free circulation (Art109(3)(a)) includes the importer, seller, buyer, manufacturer and productsupplier, the responsible EU economic operator within the meaning of Art 4 ofRegulation (EU) 2019/1020 and Art 16 of the General Product Safety Regulation,value, origin, CN code, description, consignment reference and location, and alist of the other legislation that applies. This is a materially larger dataset than the current import declaration, and it is a data set about the supplychain, not the transaction alone. The final content is left to the delegatedact under Art 109(4), constrained by the Data Model under Art 49.

Art 77 changes the release logic. Release is refused where there isevidence of non-compliance with other legislation; release is not proof ofconformity; a systematic infringement is a reason to believe for six months(Art 77(5)); consultation with other authorities is time-limited, with releasewhere the other authority has not replied within its time limit or, absent one,within five days (Art 77(6)), and a maximum suspension of 90 days; and thegoods are deemed released where customs has not selected them for controlwithin a “reasonable period” after arrival, arrival at finaldestination or sending of the pre-departure information (Art 77(7)), a termthat will need definition. Amendment of the data is allowed up to three yearsafter release (Art 79(3)), the data are invalidated where the goods have notbeen released or have not left the Union within 200 days (Art 80(1)), and thedebt is incurred at the notification of availability (Art 183(1)).

3.7Entry and exit

Art 97 establishes that goods may not enter the Union without advancecargo information (ACI). The ACI must now include the identity of the importer,the tariff classification and the value (Art 97(3)), the importer may providepart of it, and the visibility of the data to different parties is restricted(Art 97(9)). Goods may not be unloaded without ACI (Art 101(9)), temporarystorage is limited to 90 days (Art 104), and transit is the default movement onentry (Art 134). On exit, pre-departure information is required (Art 117) andthe exporter must be established. Because the importer is identified at the ACIstage and the classification and value are required before arrival, thepre-arrival process becomes a customs-risk and other-legislation-risk filter inone, and carriers will need reliable access to the importer’s data or aworkable division of responsibility for it.

3.8Special procedures

The special procedures are consolidated, with two features worth noting.Art 125 gives the EUCA the role of giving opinions on the economic conditionstest, with the Commission carrying out the Union-level examination until 21September 2027 (Art 125(12)); and Art 139 introduces the authorised consignorfor TIR next to the authorised consignee. Art 145 creates the customs warehousefor distance sales, limited to compliant goods, collective packages and bulkquantities (Art 145(2)) and available only to IOSS-active Trust and Checktraders. Recital 71 records the removal of the Rhine Manifest.

3.9The distance-sales package

The Regulation treats business-to-consumer e-commerce imports as aseparate regime, and the regime is the first to become operational. Itselements are as follows.

The importer for distance sales (Art 5(14)) is the person who supplies orfacilitates the sale, which puts platforms, marketplaces and the sellers behindthem within the importer definition and therefore within the Art 27obligations. The Union Handling Fee (Art 20) is a fixed amount per item for thehandling of a request for release for free circulation of goods sold indistance sales (Art 20(2)). It must correspond to the approximate costs ofchecking data, risk analysis, infrastructure and controls, including servicesrendered by the EUCA (Art 20(3)); it is lower where goods are sold from acustoms warehouse for distance sales (Art 20(4)); it is paid by the debtor ofthe customs debt at least monthly, and where there is no debt by the person whowould have been the debtor (Art 20(5)); and it is non-refundable (Art 20(6)).The amount itself is not in the Regulation. It is fixed by delegated act underArt 20(10), whose first adoption is due by 29 September 2026 (Art 286), anduntil 30 June 2028 the Commission provides the IT solution for its calculation(Art 20(7)). The Commission must also assess the fee by 21 September 2027 (Art279(4)).

The valuation rules for distance sales are fixed by Arts 175 and 179(4):the transaction value is the price of the distance sale itself, including wherethe sale takes place while the goods are in the distance-sales warehouse (Art175(2)), and secondary methods apply where doubts as to the declared value arenot dispelled (Art 179(4)). The customs debt is incurred on acceptance of theIOSS payment (Art 183(2)(c), from 1 July 2028), and it is extinguished wherethe goods never arrive or the sale is cancelled (Art 223(1)(m)). The simplifiedduty calculation is not available where the Union Handling Fee applies (Art90(2)). The competent authority for non-IOSS distance sales is the Member Stateof delivery (Art 6(2)(a)).

Compliance is enforced through a dedicated penalty tier (Art 276). Asystematic failure by the same operator, established where a substantive numberof controls within one calendar month show non-compliance in a sufficientlyrepresentative number of cases (Art 276(2)), attracts a pecuniary charge of atleast 1% and up to 4% of the total value of goods the operator imported intothe Union in the preceding 12 months (Art 276(1)) and mandatory suspension,revocation or annulment of any AEO or Trust and Check status and any equivalentfacilitation (Art 276(3)). A repeat within six months attracts 3% to 6% (Art276(4)); a further repeat attracts at least one of those penalties and possiblya temporary restriction of access to the operator’s online interface (Art276(5)). The classification of the importer as a high-risk economic operator inthe Hub follows automatically (Art 277). The thresholds that define”substantive” and “sufficiently representative” are thesubject of a mandatory delegated act due by 1 March 2028 (Art 286). This is theonly part of the penalty framework that sets harmonised amounts.

3.10Risk management

Title IV builds risk management as a two-layer system. At Member Statelevel, risk analysis is to be “primarily automated” (Art 55(1)), mayrely on predictive and statistical methods (Art 55(3)(b)) and recordseverything in the Hub (Art 60). Non-compliance with other legislation feeds therisk profile of the operator (Art 55(4)). At Union level, the Commission setscommon priority control areas and common risk criteria and standards, and theEUCA produces threat assessments and control recommendations that Member Statesmust follow or explain why they did not (the “comply or explain”mechanism of Art 58(1)(g), with its framework in the implementing act under Art62(1)). Until 30 June 2028 the Commission performs the EUCA risk-managementtasks (Arts 57(5) and 60(4)).

Two provisions are of particular interest to traders. Art 66(4) allowsthe authorities to extrapolate the results of a control to similar goods orconsignments and reverses the burden of proof for the extrapolated part, sothat the trader must show that the extrapolation does not apply to itsconsignments. And Art 63(3) establishes a one-stop-shop in which customs actsas coordinator for controls on behalf of other authorities, with post-releaseaccess to the systems of the operator (Art 68(1)(d)). A single control eventcan thus serve customs, market surveillance and food-safety purposes, and thetrader’s evidence must be ready for all three.

3.11Tariff, origin, value, debt and guarantees

The tariff, origin and value chapters carry over most existing law. Thenew features are procedural: Commission implementing acts determining tariffclassification with an urgency variant (Art 167(4)), a mandatory delegated acton unilateral preferential origin (Art 171(9)), and the specific value rulesfor distance sales and for export duty (Arts 175 and 180).

On debt and guarantees, Art 193 rewrites the rules on the place where thedebt is incurred, with a threshold of EUR 10,000 in Art 193(4), and Art193(1)(b)–(d) is expressly open to amendment by delegated act after the 2031supervision-models report (Art 281(5)). Comprehensive guarantees are reduced orwaived for AEO and Trust and Check traders (Art 200), subject to temporaryprohibitions (Art 201). Entry in the accounts follows within 14 days (Art 208),Trust and Check traders may calculate periodically over a maximum of 31 days(Art 205(5)), and where an authorised quantity has been exceeded a five-yearrule applies for extinguishment purposes (Art 223(1)(l)). The impact oncash-flow for a large importer is potentially significant, but it depends onthe status decisions and on the implementing acts under Arts 200(4), 205(8) and209.

3.12The European Union Customs Authority

Title XII creates the EUCA as a Union agency with its seat in Lille (Art230). Its tasks (Art 232) include operating the Hub where entrusted, supportingrisk management, supporting the application of sanctions and restrictivemeasures, crisis response, training, manuals, guidance for SMEs, opinions oneconomic conditions and joint controls. The governance follows the agencymodel. The Management Board (Art 235) comprises one member per Member State andtwo representatives of the Commission, with one Parliament representativewithout vote. The Executive Board is to be established by 21 September 2029(Art 238(2)). The Customs Advisory Board (Art 245), which is the tradeinterface, has a composition determined by the Management Board and meets atleast twice a year. Recital 92 speaks only of the intention to”endeavour” to include the trade side. There are no guaranteed seatsfor sector organisations, which is a matter for early advocacy. The DataAuditor (Arts 246–247) supervises Hub data processing. Until the ExecutiveDirector is appointed the Commission acts on behalf of the EUCA (Art 265), andthe Commission acts under Art 268(9) until 21 September 2027.

The provisions on the establishment, seat, management and structure ofthe EUCA (Arts 229–231, 234–244 and 255–265) apply from entry into force,whereas the operational tasks, the Customs Advisory Board, the Data Auditor andthe budget provisions (Arts 232–233 and 245–254) apply from 21 September 2027.The agreement with OLAF on internal investigations is due by 21 March 2027 (Art254) and the Headquarters Agreement by 21 September 2028 (Art 264).

3.13Cooperation, restrictive measures and crisis management

Title XI (Arts 225–228) introduces a crisis-management mechanism:protocols and procedures, a crisis response cell at the EUCA,business-continuity arrangements and priority treatment of cargo for AEO andTrust and Check traders. The Commission may activate the mechanism byimplementing act (Art 228(1)), with the urgency procedure available. Title XIII(Arts 266–272) creates a framework of cooperation with market-surveillance,sanitary and phytosanitary and other authorities, central units to handle datarequests, and cooperation with third countries, including automated exchangesof data (Art 272), with the Commission empowered to adopt delegated acts on theconditions (Art 272(8)) and Member States required to notify bilateralagreements by 21 September 2027 (Art 271(3)).

3.14Penalties

Title XIV does not harmonise penalties in general. Art 273 establishes aminimum list of infringements and non-criminal penalties, leaves Member Statesfree to go further (Art 273(2)) and requires penalties to be effective,proportionate and dissuasive (Art 273(3)). Art 274 contains the common list ofinfringements, Art 275 requires Member States to have regard to intent ornegligence, gravity, repetition, impact on Union and national interests andcooperation, and lists the forms that penalties can take (a pecuniary charge orsettlement, revocation, suspension or amendment of an authorisation,confiscation, a warning or another penalty). Non-criminal penalties arerecorded and made available to the EUCA through the Hub (Art 275(3)), MemberStates must notify their penalty rules by 19 March 2028 (Art 273(4)), and theCommission must evaluate the application of Art 275 by 21 September 2032,including whether harmonised pecuniary charges are warranted (Art 275(4)). Theonly harmonised amounts are those for systematic non-compliance in distancesales described in section 3.9. For international groups this means thatpenalty exposure for the same infringement will continue to differ betweenMember States, while the risk classification consequences (Art 277) and theloss of status under Art 31(7) will be Union-wide.

3.15Movement since the 30 March 2026 working text and drafting observations

The 30 March 2026 consolidated working text held in the project is atracked-changes document in which agreed and open positions are mixed, so thefollowing comparison is indicative only. Four movements stand out.

First, the bracketed application dates in the working text (2029/2032 forvoluntary use, 2032/2037 for mandatory use, full operation by 31 December 2037)have been resolved to 1 March 2031, 1 March 2034 and 1 February 2034respectively, so the transition is shorter than the longest option that was onthe table. Second, the harmonised minimum pecuniary charges for generalinfringements that appeared in the working text (30% to 100% and 100% to 200%of the duty evaded, and EUR 150 to EUR 150,000) do not appear in the OfficialJournal text, leaving national penalty regimes in place apart from Art 276.Third, the working text’s transitional reassessment of existing AEO-Cauthorisations, to check eligibility for Trust and Check status, and oftemporary-storage authorisations, to move them to customs warehousing, isabsent. Fourth, the EUCA and Hub-establishment provisions now apply from entryinto force rather than from 1 January 2028.

Three drafting points require attention. Recital 120 states that thedistance-sales and EUCA provisions apply from 1 July 2028, but Art 287 providesotherwise for a number of them; recitals do not override the operative text,but the inconsistency will need to be handled in the Commission’scommunications. The absence of grandfathering means that, unless theimplementing acts provide otherwise, existing authorisations remain governed bythe transitional provision in Art 284 only for the secondary legislation, andtheir treatment under the new Code from 21 September 2027 is left open, withthe exception of the sunset in Art 93 for the transitional simplifications (nonew grants after 28 February 2031 and expiry on 1 March 2034). And Art 285(7),which allows a transitional solution of at most six months in exceptionalcircumstances if the Hub is not ready, introduces a soft delay valve thattraders should not assume will be used, but should plan for.

4. Timetable

The table lists the principal dated events in the Regulation inchronological order, with the legal basis. Dates that are not stated in theRegulation but derive from it, or from the AI Act, are marked as such. Thedates in Art 287 govern where the recitals differ.

Date

Event

Basis

20 Sep 2026

Regulation enters into force. From this date apply: Art 5 points (15), (16), (44), (78) (distance sales, IOSS scheme, consignment, item); Art 20 except paragraphs (1), (2) and (4); Arts 35–39 and 51 (Data Hub establishment, pilot, development); Art 41(10); Art 85(2); Art 175, Art 179(4) and Art 180; the EUCA institutional provisions (Arts 229–231, 234–244, 255–265); Art 268(9); Art 272(7); all empowerments for delegated and implementing acts; Arts 282–283

Art 287(1), (3)

29 Sep 2026

Deadline for the first delegated act setting the Union Handling Fee

Arts 20(10), 286(1)(a)

Oct–Nov 2026 (computed)

Thirty-day scrutiny period for the first Union Handling Fee delegated act; Art 20(2) then applies 10 days after that act enters into force. On the statutory path this points to early-to-mid November 2026

Arts 282(7), 287(4)

21 Mar 2027

Agreement between the EUCA and OLAF on internal investigations

Art 254

1 Jul 2027

Delegated and implementing acts on the Data Hub (Arts 38(5), 38(6)) and the Data Model (Art 49) needed for distance-sales data provision

Art 286(2)(a)

21 Sep 2027

General application of the Code; Regulation (EU) No 952/2013 repealed. EUCA tasks, Customs Advisory Board, Data Auditor and budget provisions apply (Arts 232–233, 245–254). Commission assessment of the Union Handling Fee. Union-level examination of economic conditions by the Commission ends; the interim role of the Commission under Art 268(9) ends. Member States notify bilateral agreements with third countries

Arts 284(1), 287(2), Arts 279(4), 125(12), 268(9), 271(3)

2 Dec 2027 (external)

AI Act obligations for stand-alone high-risk systems (Annex III) apply, following the Digital Omnibus on AI

Reg. (EU) 2024/1689 as amended

31 Dec 2027

Commission report on centralised clearance

Art 281(1)

1 Mar 2028

Delegated act on the thresholds for systematic non-compliance in distance sales

Arts 276(6), 286(1)(b)

19 Mar 2028

Member States notify their national penalty provisions

Art 273(4)

1 Jun 2028

Data Hub functionalities for distance sales must be operational

Art 285(2)

30 Jun 2028

Last day of the customs declaration for all goods. The Commission performs the EUCA risk-management tasks and provides the IT solution for calculating the Union Handling Fee until this date

Arts 285(1), 57(5), 60(4), 20(7)

1 Jul 2028

Distance-sales importers and IOSS users provide data through the Hub. The following start to apply: Art 20(4); Arts 74 and 75; Art 109(3)(b); Art 145 (customs warehouse for distance sales); Art 183(2)(c); Art 191(2); Art 223(1)(m); Art 41 except paragraph (10) and Arts 42–45; Art 78 (release on behalf of customs by Trust and Check traders); Art 205(5), (6) and Art 208(2). “Customs declaration” is read as data provision through the Hub and “declarant” as carrier, importer, exporter or holder

Arts 285(2), 287(5), 284(2)

2 Aug 2028 (external)

AI Act obligations for high-risk systems embedded in regulated products (Annex I) apply

Reg. (EU) 2024/1689 as amended

21 Sep 2028

Headquarters Agreement for the EUCA

Art 264

1 Mar 2029

Delegated and implementing acts on the Hub and the Data Model needed for voluntary use from 2031

Art 286(2)(b)

21 Sep 2029

Executive Board of the EUCA to be established

Art 238(2)

28 Feb 2031

Last day of mandatory customs declarations for importers other than distance-sales importers, exporters and transit holders. No new authorisations for simplified declaration, centralised clearance or entry in the records after this date

Arts 285(3), 83(2), 91(1), 92(1)

1 Mar 2031

Voluntary use of the Hub by importers, exporters and transit holders. Aggregate data on request (Art 23(5))

Arts 285(4), 23(5)

21 Sep 2031, then every 5 years

Evaluation of the Regulation and of the EUCA

Arts 281(2), 262

31 Dec 2031

Commission report on supervision models. The Commission may then amend Art 6(2) and Art 193(1)(b)–(d) by delegated act

Art 281(4), (5)

21 Sep 2032

Commission evaluation of penalties, including the need for harmonised pecuniary charges

Art 275(4)

31 Jan 2033

Delegated and implementing acts on the Hub and the Data Model needed for mandatory use from 2034

Art 286(2)(c)

1 Feb 2034

All Hub functionalities to be fully operational

Art 285(6)

28 Feb 2034

Last day on which legacy systems may be used under the transitional provisions (Arts 9(6), 41(10), 76(2), 82–85, 97(13), 98(5), 101(13), 104(9), 116, 117(14), 118(5), 183(5), 204(2), 205(7))

Art 285

1 Mar 2034

Data provision through the Hub becomes mandatory. Authorisations for simplified declaration, centralised clearance and entry in the records expire

Arts 285(5), 93

Three observations follow from the table. The first is that the dates aremuch less aligned than the headline of “21 September 2027” suggests.Between entry into force and 1 July 2028 the e-commerce provisions, the EUCAand the Hub build-out proceed on their own schedules, while for the rest of thetrade the operational change is only in 2031 (optional) and 2034 (mandatory).The second is that the dependency chain for the e-commerce track is tight: adelegated act by 29 September 2026, its scrutiny, Data Hub and Data Model actsby 1 July 2027, and functionalities operational by 1 June 2028, so that anyslippage in the Data Model consultation under Art 282(4) is likely to squeezethe build window for the Hub. The third is that Art 285(7) provides a valve ofup to six months for exceptional circumstances, so that the effective outerdate for mandatory Hub use is best read as 1 March 2034 with a possible delayof up to six months on the relevant functionality, but not with an open-endedpostponement.

4.1Three tracks

The e-commerce track runs from 2026 to 2028. It brings a fee, a newimporter category, a new warehouse regime and a dedicated penalty tier, and itis the only part of the Code where the Hub is mandatory before 2034. Operatorswith a distance-sales flow into the Union should plan for the Union HandlingFee as an item-level cost from late 2026, for the Hub data model and dataprovision from mid-2028, and for the penalty and risk-classification regimefrom the same date.

The institutional track runs from entry into force to 2029. It determineswho will design and apply the system. The Management Board can be constitutedfrom entry into force, the Customs Advisory Board (Art 245) becomes availablefrom 21 September 2027, and the Executive Board must exist by 21 September2029. For organisations that want to influence the Data Model and the riskcriteria, the relevant windows fall in this period and not later.

The general transition track runs from 2027 to 2034. Between the generalapplication of the Code and 28 February 2031 the declaration remains theoperative instrument, so the changes that matter in the first years are theones that do not depend on the Hub: the responsibility and representation rulesof Arts 27 to 33, the Art 77 release logic, the new status framework, and therisk-management and control framework. In the period 2031 to 2034 the legacysystems remain permitted, and the transition to the Hub then becomes a matterof internal readiness rather than legal necessity until the mandatory date.

5. Secondary legislation: delegated and implementing acts

5.1Mechanics

The Regulation contains 86 delegated-act empowerments and 93implementing-act empowerments (these are counted at paragraph level; Art 282lists 84 articles because Arts 8(8)–(9) and 217(9)–(10) each carry two). Thecounts are my own from the Official Journal text and should be treated asindicative. The empowerments are conferred without a time limit and can berevoked by the Parliament or the Council at any time (Art 282(3)). Beforeadopting a delegated act the Commission consults experts designated by eachMember State (Art 282(4)), which means that trade participation is not builtinto the operative text. Recital 114 does, however, state that consultationsduring the preparation of delegated acts should be carried out at expert level”including the Trade Contact Group”, and that recital is the hook onwhich trade organisations should rely. Delegated acts enter into force only ifneither the Parliament nor the Council objects within two months, extendable bytwo months (Art 282(6)); the first Union Handling Fee act is subject to ashortened 30-day period (Art 282(7)).

Implementing acts are adopted with the assistance of the Customs CodeCommittee (Art 283(1)) under the examination procedure (Art 283(4)) in mostcases, and under the advisory procedure (Art 283(2)) for a limited group: theCommission decisions requesting the revocation of rulings under Art 16(12),individual repayment and remission decisions under Art 217, the Data Auditorarrangements under Art 247(4), and the authorisations for bilateral agreementsunder Art 272. Several empowerments have urgency variants for immediatelyapplicable acts (Art 283(5)): Art 62 (risk management), Art 167(4) (tariffclassification), Art 201(3) (guarantee prohibitions) and Art 228 (crisis), and,as I read them, Arts 172 and 182. Two provisions foresee guidelines rather thanacts (Arts 6(8) and 32(2)).

Three delegated acts are mandatory (“shall”): the EU CustomsData Model (Art 49), unilateral preferential origin (Art 171(9)) and thesystematic non-compliance thresholds (Art 276(6)). All other empowerments arediscretionary in form (“is empowered”), but many of them arepractically indispensable, because without them the level-one text cannotoperate. This is true in particular of the data-set empowerments in Arts 74(8),97(11), 109(4) and 117(12). It is unclear from the text alone how theseinteract with the Data Model of Art 49: my reading is that the Data Modelprovides the common vocabulary and the data-set acts specify content perprocedure, but the Regulation does not say so. Art 286(2) mentions only Arts38(5), 38(6) and 49 for the phase deadlines, so the sequencing of the data-setacts is not fixed in the level-one text.

Existing delegated and implementing acts adopted under Regulation (EU) No952/2013 continue to apply until repealed (Art 284), and references toRegulation (EU) No 952/2013 are read in accordance with the correlation tablein the Annex (Art 284(1)). The existing secondary law of the 2013 Codetherefore continues to apply until the Commission repeals it. For the trade,the practical effect is that the legal text will for some time be a compositeof the new Regulation and the old secondary law, read through the correlationtable and, after 1 July 2028, through the conversion rule in Art 284(2).

5.2Categories

The table groups the empowerments into 17 categories according to thesubject matter. Article numbers refer to the empowering articles; the fullparagraph-level references are in Annex A.

5.3Sequencing and windows for input

Not all categories are equally urgent. The immediate item is category 2,with the fee delegated act due within ten days. The second wave is the Data Huband Data Model package (category 4) together with the e-commerce data sets(parts of categories 6, 9, 10 and 12), which must be in place by 1 July 2027for the 2028 distance-sales go-live. The third wave is the status,representation and risk cluster (categories 3, 5 and 14), which has nodedicated statutory deadline but which determines the value of the reform tothe trade and, on the face of the text, needs to be ready for generalapplication on 21 September 2027. The fourth wave is the general Data Hub, withthe acts for the 2031 and 2034 steps due by 1 March 2029 and 31 January 2033.

For advocacy, the important structural point is that trade organisationshave no formal role in the adoption of delegated acts beyond what theCommission chooses to offer: the expert consultation under Art 282(4) is withMember State experts. The practical channels are therefore the Trade ContactGroup named in recital 114, the Customs Code Committee and its working groupsthrough the Member States, the Customs Advisory Board when it exists, anddirect engagement with the Commission and the co-legislators during thescrutiny periods. The categories where the operational impact on brokers,carriers and integrators is highest, and where early engagement is worth theeffort, are the data-set acts (Arts 74(8), 97(11), 109(4) and 117(12)), therepresentation acts (Art 33(8)), the status acts (Arts 29(10), 31(6) and31(12)), the Art 77(10) act on refusal and suspension of release, therelease-on-behalf act (Art 78(7)), and the guarantee acts (Arts 200(4),205(8)).

6. Artificial intelligence: where it helps authorities andcompliant trade

6.1What the text says

The Regulation treats AI as a normal tool of customs, subject to thegeneral law on AI. Five provisions carry that position. Art 5(34) defines riskanalysis as processing of data, including personal data, using where relevantanalytical methods and AI systems as defined in Art 3(1) of Regulation (EU)2024/1689, and Art 5(35)–(36) distinguish the risk signal from the riskanalysis result, which may be reached by an automatic process or by furtherhuman assessment. Art 55(1) requires risk management to be based primarily onautomated risk analysis, and Art 55(3)(b) allows predictive and statisticalmethods. Art 38(3)(c) requires the Hub to enable risk, economic and dataanalysis, customs simplification and trade facilitation, including through AIsystems in accordance with the AI Act. Recital 28 adds that the Hub shouldprovide a wide range of advanced data analytics, including through AI, tofacilitate risk, economic and predictive analysis and should exploit existingrisk-information sources such as RASFF, Safety Gate, ICSMS and the IPEnforcement Portal. Finally, Art 38(4) provides that acts performed using theHub functionalities remain the acts of the persons and authorities concernedeven if automated, and recital 27 draws on the Euranimi judgment for the sameprinciple.

The Regulation is therefore not neutral on AI: it mandates automation forauthorities and provides a platform for it. What it does not do is to give thetrade a defined role in the AI layer. The Hub functionalities of Art 38(3)include the reporting of non-compliant goods (Art 38(3)(i)), data portability(Art 38(3)(k)) and re-use of data to the highest extent possible (Art38(3)(m)), but the text provides no entitlement of a trader to explanation of arisk outcome other than the general rights to be heard and to reasons in Art8(6)–(7).

6.2Where AI helps the authorities

The following table sets out fifteen use cases that follow from the textof the Regulation, with the provision that supports each one, the benefit, andthe guardrail that the Regulation or the general law imposes. The list is not atechnology roadmap: each use case is anchored in the text, and technicalmaturity varies widely.

Use case

Anchor

Benefit

Guardrail

Automated risk analysis and targeting at scale over Hub data, including predictive and statistical models

Arts 5(34)–(36), 38(3)(c), 55(1), 55(3)(b)

Selection of consignments and operators across all Member States on the full Hub dataset instead of national silos; consistent risk scoring

AI Act classification to be settled; human assessment for adverse outcomes; automation does not shift responsibility (Art 38(4)); record in the Hub (Art 60)

Cross-border signal fusion and anomaly detection (undervaluation, misclassification, origin fraud, network patterns)

Arts 56–58, 60; recital 28

Detects fraud patterns that are invisible to a single Member State; feeds EUCA threat assessments and control recommendations

Purpose limitation (Art 41(1)); data quality; comply-or-explain mechanism (Art 58(1)(g)) requires explainable outputs

Tariff classification plausibility checks at data entry (description against CN code, historic behaviour, BTI database)

Arts 109(3)(a), 167, 15–16

Early detection of misclassification before release; supports uniform classification across Member States

Classification decisions remain those of the customs authority; BTI stays authoritative; right to be heard (Art 8(6))

Valuation benchmarking and price-outlier detection, including distance sales

Arts 175, 179(4), 20

Objective basis for secondary valuation methods where doubts are not dispelled; item-level analytics for high-volume low-value flows

Doubts must be reasoned and communicated; benchmark transparency is needed to withstand appeal

Origin and preference verification (document reading, supplier-network analysis, consistency of proofs)

Arts 169–171

Targets verification requests where preferential claims are implausible; reduces random verification burden on compliant traders

Verification remains a formal procedure; model outputs are leads, not proof

Other-legislation screening (matching product data with safety alerts, conformity declarations and restricted-substance data)

Arts 27(2)(c), 42, 77, 109(3)(a); recital 28 (RASFF, Safety Gate, ICSMS)

Makes the “evidence of non-compliance” threshold of Art 77 operational at volume, with shared evidence across authorities

Refusal requires evidence, not a score; consultation time limits (Art 77(6)); data-sharing scope (Arts 42, 43)

Routing and scheduling of coordinated controls across authorities (one-stop-shop)

Arts 63(3), 68

One control event serving several authorities; fewer duplicate inspections; better use of scarce inspection capacity

Allocation rules and confidentiality between authorities; auditability of routing decisions

Extrapolation of control results to similar consignments with statistical rigour

Art 66(4)

Defensible similarity and sampling criteria; scalable audits

Because the burden of proof is reversed, similarity criteria must be disclosed in a form the trader can contest

Continuous monitoring of AEO and Trust and Check holders (signals for suspension, revocation and deeper audit)

Arts 9(4), 29, 31(7), 276(3)

Replaces periodic visits by continuous supervision on the Hub data; concentrates audit effort on real anomalies

Proportionality; mandatory triggers must be tested on legal criteria, not scores; right to be heard

Statistical detection of systematic non-compliance in distance sales

Arts 276(2), 276(6), 277

Provides the “substantive number” and “sufficiently representative” tests with a sound statistical footing

Thresholds are set by delegated act; consequences (pecuniary charge, loss of status) require human legal determination

Data-quality, identity and duplicate checks in the Hub (registration, entity resolution, manufacturer and product-supplier data)

Arts 26, 38(3)(b), 49

Cleaner data model and fewer false alerts; supports the responsible-EU-operator link

Governed by the Data Model; Data Auditor oversight (Arts 246–247)

Post-release audit and control selection, including amendment requests up to three years after release

Arts 68(1)(d), 79(3)

Risk-based post-release audit on data already in the Hub

Retention and access rules (Arts 45, 47); limitation periods

Document processing, translation and drafting support; guidance and chat support to SMEs

Arts 76, 232

Cuts administrative load in the digital-copy regime; multilingual SME guidance at EUCA level

Limited to assistance; no automated adverse decisions; confidentiality of Hub data (Art 37)

Sanctions and restrictive-measures screening; early warning and crisis dashboards

Arts 225–228, 232

Faster identification of diverted or restricted flows and of crisis impacts, with priority cargo handling

Human decision on measures; accuracy and false-positive cost for compliant trade

Training, simulation and knowledge management for customs staff

Art 232; recital 90

Consistent application across 27 administrations; support for the training obligations

Content governance; no substitution for legal advice or decisions

The largest gains for the authorities are in the first six rows.Union-level pooling of data in the Hub creates a scale for risk analysis thatno national system has had, and the cross-domain access rights in Arts 42 and43 allow signals from tax, product safety and food safety to be combined withcustoms data. The operational result should be fewer, better-targeted controls.The compliant trade has a direct interest in this outcome, as long as modelsare validated for false positives, since a poorly calibrated risk modelproduces delay and cost precisely for the operators with the cleanest data.

6.3Where AI helps compliant trade

For the trade the benefit of AI comes from turning the Regulation’s dataobligations into a competitive capability. The new Code moves the trader fromlodging a declaration to maintaining a supply-chain data set that is visible toseveral authorities, and it moves responsibility for other legislation onto theimporter and, through Art 33(2), on to the indirect representative. Bothchanges reward organisations that can produce accurate, consistent andtraceable data at scale. The following table sets out thirteen use cases.

Use case

Anchor

Benefit

Guardrail

Product-data and classification engine: map catalogue and ERP data to CN codes with confidence scores and audit trail

Arts 15, 109(3)(a), 167

Consistent classification at scale; reuse of BTI; evidence file for the Art 109(3) data set

Legal responsibility stays with importer or representative (Arts 33(2), 38(4)); human sign-off on low-confidence cases

Assembling the Art 109(3) data set from heterogeneous sources (supplier, manufacturer, product supplier, responsible EU operator)

Arts 49, 109(3)(a)

Entity resolution and validation across suppliers; a reusable data supply chain for all procedures

Aligned to the Data Model once adopted; supplier data-sharing agreements

Mapping products to applicable other legislation and checking certificates and declarations of conformity

Arts 27(2)(c), 77

Reduces the risk of release refusal and of Art 31(7) suspension; makes product compliance part of the customs workflow

Automated mapping is advisory; legal review for new product categories

Pre-arrival data quality and reconciliation between importer, carrier and consignee data (ACI)

Arts 97, 100, 101(9)

Fewer invalidations and holds; clear division of responsibility between carrier and importer

Visibility restrictions (Art 97(9)); data-sharing terms

Valuation consistency: related-party pricing, assists, royalties and adjustment detection

Arts 175, 179(4) and the general value rules

Early identification of valuation exposure before post-release amendment or audit

Results must be reviewed by valuation specialists; transfer-pricing alignment

Rules-of-origin engine and supplier-declaration management

Arts 169–171

Maximises correct preference use; documented evidence for verification requests

Supplier declarations must be authentic; keep the audit trail

Continuous self-monitoring of own customs data (anomaly detection, control testing, exception handling)

Arts 9(2), 29, 31

The evidence base for holding Trust and Check status; early correction of errors before they become infringements

Governance of the control framework; no reliance on the model as a sole control

Trust and Check readiness assessment (gap analysis against criteria, evidence generation)

Art 31

Shortens time to status; shows management the business case

Assessment is internal; status decision is the authority’s

Duty, guarantee and cash-flow forecasting; periodic-calculation and deferred-payment optimisation

Arts 200, 205, 208, 212

Quantifies the liquidity benefit of status; optimises guarantee usage

Depends on implementing acts; treasury sign-off

Principal due diligence and risk scoring for representatives (KYC, product-compliance history, monitoring of principals)

Arts 33(2)–(3), 33(7)

Manages the new joint-and-several exposure of the indirect representative; supports pricing and contract terms

Fair treatment of clients; data protection; contractual allocation of responsibility

Distance-sales economics: item-level Union Handling Fee modelling, warehouse versus direct-flow optimisation, IOSS reconciliation, cancellation handling

Arts 20, 145, 183(2)(c), 223(1)(m)

Optimises the flow mix once the fee is set; automates reconciliation of debt and cancellations

Fee amount and rules are subject to the delegated act; warehouse access limited to Trust and Check IOSS traders

Handling controls and requests: drafting responses, right-to-be-heard submissions, rebuttal of extrapolation

Arts 8(6)–(7), 66(4), 77

Faster, better-documented responses to controls and holds

Legal review; confidentiality of privileged material; no client data in non-compliant tools

Regulatory intelligence: tracking the 86 delegated and 93 implementing acts, impact mapping and consultation drafting

Arts 282–283, recital 114

Early sight of drafts and of scrutiny windows; input to Trade Contact Group work

Human validation of legal interpretation

The economic case rests on Trust and Check status. Its benefits(post-release completion, release on behalf of customs, own controls, periodicdebt calculation and deferred payment) are conditional on a control environmentthat is real-time, monitored and auditable, and are lost on fraud or oninfringement of other legislation (Art 31(7)). AI-assisted self-monitoring isthe most cost-effective way to meet that standard for high-volume traders, andthe evidence it generates is directly relevant to the in-depth monitoring atleast every two years. For representatives, the same tools are needed for adifferent reason: the joint and several responsibility of Art 33(2) makesprincipal due diligence and product-compliance monitoring a core service, notan optional one.

6.4Constraints

Six constraints determine how far and how fast either side can go. Thefirst is the sovereignty rule. Art 37 requires Hub infrastructure to be locatedin the Union and to be provided by suppliers free of third-country legal reach,and Art 37(6) prohibits transfers of data processed in the Hub outside theUnion. The wording is passive (data processed in the Hub “shall not betransferred or made available” to a third country or to personsestablished outside the Union, unless Title III or XIII or an internationalagreement provides otherwise) and does not name its addressee, so it is atleast arguable that it also reaches onward transfers by users. Together withArt 41(1), traders should assume that Hub-derived data cannot simply be passedto non-Union group entities or non-Union AI providers without a specific legalanalysis. For authorities the consequence is that AI capability for the Hubwill have to be sourced from Union-controlled suppliers, which narrows themarket and raises the cost.

The second is purpose limitation. Under Art 41(1) a person may processthe Hub data that it transmitted, that was transmitted on its behalf or that isaddressed to it exclusively to exercise its rights or fulfil its obligationsunder customs legislation and other legislation applied by the customsauthorities, and to demonstrate compliance. Analytics that go beyond that, suchas model training on Hub data for commercial benchmarking, are not covered, andthe same applies to authorities whose access is defined by function (Arts 42and 43). The third is responsibility: Art 38(4) means that neither an authoritynor a trader can defend an error by reference to a model. The fourth isprocedure. Where an AI-supported outcome adversely affects a person, the rightsto be heard and to reasons (Art 8(6)–(7)) apply, and, for natural persons, Art22 of the GDPR and Art 11 of the Law Enforcement Directive on automatedindividual decisions are relevant; the personal-data and offences-data rules inArts 44, 45 and 47 also apply to model inputs.

The fifth is the AI Act. The Digital Omnibus on AI, approved by theCouncil on 29 June 2026, postponed the application of the high-riskobligations: stand-alone systems listed in Annex III apply from 2 December 2027and systems embedded in regulated products (Annex I) from 2 August 2028. Thosedates fall after the general application of the Code (21 September 2027) andaround the start of EUCA responsibility for Hub risk functions (1 July 2028).Whether customs risk engines are high-risk systems is an open question that theRegulation does not settle. My preliminary view is that risk scoring of goodsand legal-entity operators is largely outside the listed use cases, but thatrisk analysis of “persons” under Art 55(1)–(2) and any profiling forlaw-enforcement purposes could engage the border-control and law-enforcementcategories of Annex III; this needs a structured assessment by the Commissionand the EUCA. The sixth is data quality and explainability: the “comply orexplain” mechanism of Art 58(1)(g) and the reverse burden of proof in Art66(4) both require that risk criteria and similarity judgments can beexplained, at least to the authorities and the Data Auditor.

6.5Assessment and suggested positions

The AI opportunity is largest where the Regulation creates a dataobligation that is expensive to meet manually and where the benefit ismeasurable: classification, the Art 109(3) data set, other-legislation mapping,self-monitoring for Trust and Check status, and, for the authorities,Union-level risk pooling. It is smallest where a decision affects legalposition without a clear human accountable, and where the sovereignty rulelimits tool choice. A sensible sequence for the trade is data foundations in 2026to 2027 (supplier and product data, classification governance, Art 109(3)mapping), followed by self-monitoring and status readiness ahead of the 2028benefits, and only then by more advanced applications such as predictivecash-flow and principal scoring.

For advocacy, four positions follow. The trade should ask the Commissionand the EUCA to publish a statement on the AI Act classification of Hub riskfunctions before the high-risk obligations apply. It should ask that the DataModel and the Hub functionalities include a trader-facing pre-validationservice for the Art 109(3) data set, so that quality assurance can be donebefore submission and not discovered through release refusal. It should ask fortransparency on the categories (not the content) of risk criteria and for afeedback mechanism to correct systematic false positives, using the CustomsAdvisory Board as the channel. And it should ask that guidance under Arts 6(8)and 32(2) address the use of AI in the discharge of the responsibility of importersand representatives, so that reliance on properly governed automation isrecognised as part of reasonable care.

7. Points for immediate attention

Point

Window

Why it matters

First Union Handling Fee delegated act

Adoption by 29 Sep 2026; 30-day scrutiny (Art 282(7))

Sets the amount, per-item mechanics and the warehouse differential from around November 2026. The shortened scrutiny period leaves little time for input, so contact with the Commission, the Parliament and the Council should start now

Data Model and Hub acts (Arts 38(5), 38(6), 49)

By 1 Jul 2027 for the distance-sales phase

Everything else in the data architecture depends on it. Seek participation through the Trade Contact Group and the Customs Code Committee channels before the Art 282(4) expert consultation

Customs Advisory Board composition

Management Board decision; the Board is available from 21 Sep 2027

No guaranteed sector seats (Art 245, recital 92). Composition and selection criteria should be addressed with the Management Board and Member State representatives early

Representation and status planning

Before 21 Sep 2027 and for 1 Jul 2028

Joint and several responsibility (Art 33(2)), the deemed-importer rule (Art 33(3)), and the status gate for cross-border representation (Art 33(7)) require review of representation contracts, indemnities, insurance and status applications (AEO-C and Trust and Check)

Grandfathering and continuity of authorisations

Commission guidelines (Arts 6(8), 32(2)) and implementing acts

The Regulation contains no express reassessment or carry-over provision for existing authorisations. A written Commission position is needed before 21 Sep 2027

Recital 120 versus Art 287

Clarification via Commission communication

Different application dates for distance-sales and EUCA provisions between recital and operative text; the operative text controls

Hub readiness

Functionalities by 1 Jun 2028; fallback of up to 6 months (Art 285(7))

The go-live for distance sales is the first real test of the Hub; contingency planning is needed for the fallback period

AI Act classification of Hub risk functions

Before 2 Dec 2027

Determines the regulatory regime and the transparency the trade can expect for AI-supported outcomes

Annex A: Inventory of delegated and implementing empowerments bycategory

The inventory lists the empowering provisions at paragraph level.”DA” means delegated act (Art 282) and “IA” implementingact (Art 283). The classification into categories is the author’s. Where anarticle carries several empowerments, they are listed separately. Provisionsmarked with an urgency variant are described in section 5.1.

New UCC first reading