EU Customs Reform Is Now Law

Why this feature replaces our May 2026 paper

Our May feature analysed the political agreement of March 2026. The Regulation has since been adopted, published and brought into force, and several dates and legal positions in the May paper have been overtaken. We have withdrawn it rather than patch it.

Every date and legal statement below is checked against the text of Regulation (EU) 2026/2108 as published in the Official Journal, and against Council, Parliament and Commission material. Where a point depends on an act the Commission has not yet adopted, we say so. Where a statement is ECTM analysis rather than law, we label it.

The number eight is ours. The EU has not published an official list of eight changes. These are the eight we think matter most to businesses.

The dates that matter

Dates come from Regulation (EU) 2026/2108 unless another source is named.

1. The reform is now law

Regulation (EU) 2026/2108 was adopted on 16 September 2026 and published in the Official Journal on 19 September. It entered into force on 20 September, the day after publication (Article 287(1)). It establishes the European Union Customs Authority. It will repeal the current Union Customs Code, Regulation (EU) No 952/2013, from 21 September 2027 (Article 284, read with Article 287(2); recital 120 says the repeal takes effect only after a 12-month adaptation period). The Council approved the text on 3 September and Parliament gave its final approval on 16 September.

In force does not mean in use. Most of the Regulation applies from 21 September 2027 (Article 287(2)). A first group of provisions applies from entry into force: the legal basis of the EU Customs Data Hub, the Customs Authority's institutional set-up and the Commission's powers to adopt the delegated and implementing acts that will carry the detail (Article 287(3)). A second group waits until 1 July 2028, including the Data Hub obligations for e-commerce (Article 287(5)).

Existing rules do not vanish overnight. Delegated and implementing acts adopted under the current Code continue to apply until the Commission repeals them by acts adopted under the new Regulation (Article 284(1)). From 1 July 2028, references to the customs declaration are read as covering the provision of data through the Hub, and references to the declarant as covering the carrier, importer, exporter or holder of the transit procedure (Article 284(2)).

The Council and the Commission both describe the reform as the largest since the customs union was created in 1968. That is an institutional characterisation. The practical point is narrower: the rules are now fixed in law, and the dates in this feature are legal deadlines, not intentions.

2. The Data Hub now has a legal spine and a fixed timetable

The Regulation itself establishes the EU Customs Data Hub (Article 35) as a secure, cyber-resilient central IT platform for data exchange with and between customs authorities (Article 36). Parliament says it will replace at least 111 systems used by customs authorities across Europe. The Commission describes it as giving authorities a 360-degree overview of supply chains and the movement of goods.

The timetable

• Until 30 June 2028: goods are covered by a customs declaration, as now (Article 285(1)).
• From 1 July 2028: importers for distance sales, and businesses that use IOSS, provide their data through the Hub. The functionalities must be operational by 1 June 2028 (Article 285(2)). For IOSS sales, the data is due at the latest on the day after payment is accepted, and before the goods are notified as available (Article 74(3)).
• From 1 March 2031: other importers, exporters and holders of the transit procedure may use the Hub instead of a customs declaration (Article 285(4)).
• From 1 March 2034: use of the Hub is mandatory for all of them. Full functionality is required by 1 February 2034 (Article 285(5) and (6)).

Two safety valves matter. If a Hub functionality is not ready on time, the Commission must provide a transitional solution for up to six months (Article 285(7)). Separately, the Commission must assess by 1 December 2027 whether the central IT infrastructure will be operational by 1 July 2028, and may propose extending the EUR 3 duty if it will not (Regulation (EU) 2026/382, Article 3(2)). Plan to 1 July 2028. Watch 1 December 2027.

What the law promises

The Hub must offer a single access point and multilingual interfaces, allow data to be re-used "to the highest extent possible", and allow data to be ported into national systems. Its use of artificial intelligence must comply with the EU AI Act, Regulation (EU) 2024/1689 (Article 38(3)). Acts performed through automated functionalities remain the acts of the persons and authorities that use them (Article 38(4)).

On digital sovereignty, the infrastructure must be located in the Union and solely controlled by the Commission or the Customs Authority. Suppliers and their subcontractors must be established in the Union and free from third-country disclosure laws. Data in the Hub may not be transferred to third countries except as the Regulation or an international agreement allows (Article 37).

Who can see and use your data

From 1 July 2028 (Articles 41 to 45, applying under Article 287(5)), Hub data can be processed by far more than customs. It can include personal and commercially sensitive data. In each case the Regulation limits use to defined purposes and to what is necessary:

• Customs authorities: to apply customs and other legislation, including determining duty and tax liability, and for controls, risk management and cooperation (Article 41(2)).
• The Customs Authority and the Commission: for risk management, tariff classification, origin and value, restrictive measures, statistics and monitoring the uniform application of the rules (Article 41(3) and (4)).
• OLAF: for its customs-related anti-fraud work (Article 41(5)).
• Member State tax authorities: to determine liability for excise duty, fees and taxes on the goods concerned (Article 41(6)).
• National statistical authorities: for official statistics (Article 41(7)).
• Food, feed and plant authorities, and market surveillance authorities: to enforce the rules on placing products on the market and on product safety, and to cooperate with customs in keeping non-compliant goods out (Article 41(8) and (9)).

The European Public Prosecutor's Office, Europol and Frontex may also request data through the Customs Authority. Europol may obtain personal and commercially sensitive data where its tasks relate to customs matters. Frontex may obtain only non-personal or aggregated data (Articles 42 and 43). The Customs Authority must inform OLAF of suspected fraud (Article 57(2)(e)).

For most of these authorities the Commission will set out by implementing act which categories of data each may process, what safeguards apply and whether onward sharing should be restricted (Article 41(12)). Personal data may not be kept longer than necessary, and in any event not longer than 10 years from the date it is recorded. Longer retention is allowed only in the cases in Article 68 and for investigations by OLAF, the Public Prosecutor's Office or national authorities, Commission infringement procedures, and administrative or judicial proceedings (Article 45(1)).

What the law does not say

Our May paper said Hub data would be screened against sanctions lists and export-control databases. The Regulation does not say that. It gives the Customs Authority a role in supporting the supervision of EU restrictive measures, and it requires customs authorities to report suspected circumvention, wherever possible through the Hub (Articles 225 and 226). We still expect Hub data to make sanctions and product-compliance gaps more visible. That is ECTM analysis, not a provision of the law.

3. The EU Customs Authority will be based in Lille, and national customs still decide

The seat is fixed in law in Lille, France (Article 230), but the Authority is still being set up. Parliament and the Council chose the seat by joint vote on 25 March 2026. The Commission expects around 285 staff; earlier Council material said around 250. The Council and the Commission expect activities to begin in 2027, and the Commission has launched a task force to prepare the Authority. Until 30 June 2028 the Commission may carry out the Authority's risk-management tasks itself (Article 57(5)).

The division of roles is more precise than our May paper suggested:

• The Commission may establish common priority control areas and common risk criteria and standards (Article 56(1)).
• The Customs Authority conducts Union-level risk management, may submit input to the Commission on those criteria, develops common risk analysis and issues control recommendations to customs authorities (Article 57).
• National customs authorities take the control decisions, and must explain to the Customs Authority when they do not follow a recommendation (Article 58(1)(e) and (g)).

4. The EUR 3 duty is already operating

Council Regulation (EU) 2026/382 of 11 February 2026 deletes the customs duty relief for consignments of up to EUR 150 (Article 1). Article 2 then applies, from 1 July 2026 until 1 July 2028, a customs duty of EUR 3 per item in a consignment with a total intrinsic value not exceeding EUR 150. It is not EUR 3 per parcel. In practice the Commission applies it per declaration line, so the declaration type matters (see below).

An "item" is one or more goods in a consignment that share the same tariff classification, description and, where required, origin (Regulation (EU) 2026/2108, Article 5(78)). The Commission's news item of 8 June 2026 gives simple examples: five T-shirts count as one item and attract EUR 3; one T-shirt and one watch count as two items and attract EUR 6. In the guidance, the declarant pays first. The consumer pays only in residual cases where a Member State offers a free web-based declaration tool.

The declaration type decides how many lines you pay for

The Commission's guidance says that, because of limits in the customs IT systems, the EUR 3 duty applies automatically per declaration line, whatever the quantity on that line (section 3.3.1). The rate is the same for every declaration type. The number of lines is not, because each type asks for a different level of tariff detail.

The guidance gives an example: a consignment of three different articles worth EUR 140, all under the same eight-digit CN code but with three different TARIC codes.

The Commission's Access2Markets service gives the same illustration (30 June 2026): three goods that share a CN code but carry different TARIC codes take one line and EUR 3 in H6 or H7, and three lines and EUR 9 in H1.

Origin can add a second split. In H1, goods with the same TARIC code but different origins are separate lines. The guidance's bicycle-parts example counts the same code from China and from Thailand as two lines, and so two charges. The Commission's questions and answers of 30 June 2026 add a practical point: because the duty is applied per line, economic operators should be encouraged to use one line for goods that share a tariff classification in H7.

You may not have a free choice. H7 cannot be used for restricted goods, and H1 is mandatory in the three cases in the table. Recital 80 of Regulation (EU) 2026/2108 says that, in distance sales, the declarant would typically be the person entitled to use IOSS or an indirect customs representative. Ask that person which type they will file, and how many lines it produces for your typical basket.

A gap between the law and the guidance

The wording of Article 2 is narrower than the Commission's guidance. Article 2 applies the EUR 3 duty only where the import is VAT-exempt as an IOSS import (Directive 2006/112/EC, Article 143(1), point (ca)) or where the goods are in a postal consignment. Recital 6 adds that the Common Customs Tariff should continue to apply to other operators not registered for IOSS.

The guidance says the intention is for the EUR 3 duty to apply to all goods in distance-sales consignments of up to EUR 150, whichever VAT procedure is used: IOSS, the special arrangements or the standard procedure. The guidance describes itself as explanatory and not legally binding.

Product identifiers: the earliest systems deadline

The Commission's guidance sets four document codes, declared as a supporting document (data element 12 03). C127 is a merchant product identifier, assigned by the seller, marketplace or platform. C128 is a manufacturer identifier that does not follow an international standard. C129 is a manufacturer identifier that does, such as an EAN or ISBN. Y081 confirms that no standardised manufacturer identifier exists.

Declaring them has been voluntary since 1 July 2026 and becomes mandatory on 1 November 2026. The guidance applies this to imported goods sold in distance sales, whichever VAT procedure is used. It says effective enforcement starts on 1 November and that no sanction applies before then. It does not say that a declaration will be rejected without an identifier, but it treats a failure to provide complete and accurate data as an infringement. Preparation means capturing an identifier for every product, choosing the right code and passing it to whoever lodges your declaration.

Two dates to watch. The Commission must assess trade diversion every month from 1 October 2026, and can propose extending the flat duty to all goods in consignments of up to EUR 150 (Article 3(1)). Product identifiers become mandatory on 1 November 2026.

5. The handling fee is separate, and it has no price yet

The Union handling fee is not a customs duty, and it is not part of the EUR 3. Our May paper combined them and dated both to 1 July 2026. That was wrong. The fee is a fixed amount per item, charged for handling a request to release goods sold in distance sales for free circulation (Article 20(2)). It covers the costs of checking data, risk analysis, infrastructure and controls, including services rendered by the Customs Authority (Article 20(3)).

• Who pays: the debtor of the customs debt at import, at least once a month. The consumer is not a debtor (Article 20(5); recital 80).
• Refunds: the fee is non-refundable (Article 20(6)).
• A lower fee applies to goods sold from a customs warehouse for distance sales, from 1 July 2028 (Articles 20(4) and 287(5)). Access to that route is narrow: see change 7.
• Review: the Commission reports every two years on the costs the fee covers (Article 20(8)) and must assess its functioning, including its effect on distance sales, by 21 September 2027 (Article 279(4)).
• Other charges: Member States may charge separately for specific services such as attendance outside office hours or exceptional control measures (Article 20(9)).

The amount is not set. The Commission must adopt the delegated act that fixes it by 29 September 2026 (Article 286(1)(a)). That act enters into force only if neither Parliament nor the Council objects within 30 days of notification (Article 282(7)), and the fee provision then applies 10 days after the act enters into force (Article 287(4)). The Council, Parliament and Commission say collection will start by 1 November 2026 at the latest. No amount had been published in the sources we checked at 21 September 2026. Figures circulating online are estimates, not law.

6. Responsibility moves upstream for e-commerce

The Regulation defines an "importer for distance sales" as either the person supplying the goods or the person facilitating the sale (Article 5(14)). That covers sellers and platforms. As importer, they must provide the customs data, ensure payment of customs duties and other applicable charges, and ensure the goods comply with other legislation the customs authorities apply (Article 27(2)).

An importer must be established in the Union or be represented by an indirect representative that is (Article 27(3)). For IOSS sales, a non-EU importer for distance sales must appoint such a representative (Article 85(4)(d)). To place goods sold in distance sales into free circulation, an indirect representative must hold either authorised economic operator (AEO) status for customs simplification or Trust and Check status (Article 33(7)). Parliament says the aim is to stop shell companies being used to avoid the rules.

Our May paper said platforms must hold AEO status by November 2026. That is wrong on both the requirement and the date.

Indirect representatives share the liability

Acting as an indirect representative carries real exposure. A representative acting for an importer established in the Union is jointly and severally responsible with that importer for the importer's duties under Article 27(2) (Article 33(2)). Where the importer is not established in the Union, the representative is treated as the importer (Article 33(3)). For the customs debt itself, the representative and the person on whose behalf it acts are both debtors and jointly and severally liable (Article 183(3), applying generally from 21 September 2027). Anyone who supplies information that they knew, or should reasonably have known, was false, so that duty is not collected, also becomes a debtor (Article 183(4)).

For brokers and logistics providers this is a commercial issue, not a technical detail. Before accepting an indirect-representation role, review the authority, liability, indemnity, data-verification and termination terms of your contracts.

Timing needs care. Article 287 gives different provisions different start dates. From 1 July 2028 (Article 287(5)) apply the rules on notifying the availability of goods, including the IOSS data timing rule (Articles 74 and 75), customs warehouses for distance sales (Article 145), the lower handling fee (Article 20(4)), Trust and Check release on behalf of customs (Article 78) and the wider Hub data access rules (Articles 41 to 45). Article 85(2) applies from entry into force and keeps declarations for distance sales with the IOSS user, the special-arrangement user or their indirect representative until 30 June 2028. On the face of Article 287, provisions it does not name apply generally from 21 September 2027. That includes the rules on the importer, representatives and the customs debt in Articles 27, 33 and 183, apart from Article 183(2)(c).

Recital 120 says the provisions on distance sales should apply from 1 July 2028. The operative dates in Article 287 are more detailed. Plan to 1 July 2028 for Hub obligations, and take specialist advice on what applies between 21 September 2027 and that date.

7. Trust and Check is more demanding than most summaries suggest

Trust and Check is a separate status from AEO, and AEO remains in place alongside it. Parliament notes that AEO stays available to keep customs status accessible to smaller operators. Trust and Check is a record-based status, and the conditions are substantial (Article 31):

• The applicant must be an importer, exporter or indirect representative established in the Union with at least two years of regular customs operations.
• Customs authorities examine the applicant's relevant data for the last three years.
• The applicant needs an electronic system that provides customs with data on the movement and compliance of goods as close to real time as technically possible, and makes records available through the Hub, including its accounting system, commercial and transport records and tracking systems.
• It must show practical competence, including on how to interact through the Hub, and financial solvency, including a record of meeting duty and tax payments over the previous three years.
• Importers for distance sales must have been registered for IOSS, and made appropriate use of it, for at least two years (Article 31(3)(g)).
• Authorities monitor the status continuously and carry out an in-depth review, including an on-site visit, at least every two years. Fraud triggers suspension.

The benefits are real but conditional. Customs authorities grant one or more simplifications depending on the trader's activities, such as providing part of the data after release, periodic settlement of duty and deferred payment (Article 31(8)). Release of goods on behalf of customs is something authorities "may authorise" (Article 78), on the basis of real-time information. It is not automatic. The Member State where a Trust and Check trader is established becomes the competent customs authority for its imports and exports (Article 6(2)(b)). It can ask other Member States to carry out controls, and those Member States keep their own controls too (Article 6(3) and (4)).

Customs warehouses for distance sales are narrower than the shorthand suggests. From 1 July 2028, only an importer for distance sales that has chosen to use IOSS and holds Trust and Check status, or its indirect representative holding that status, may be authorised to store and operate goods in a private customs warehouse before a sale (Article 145(1)). All three conditions apply: importer for distance sales, IOSS and Trust and Check. The goods must also comply with the other legislation customs applies, be packed in collective packages of alike goods and arrive in quantities that allow effective controls, taking account of the size of the entity (Article 145(2)). Authorities may check the goods before they enter the warehouse and while they are stored (Article 145(3)). The Commission will set the authorisation conditions by delegated act (Article 145(4)).

A timing gap for newcomers. Both two-year tests look back at your record. An importer for distance sales must have been registered for IOSS, and made appropriate use of it, for at least two years (Article 31(3)(g)), on top of two years of regular customs operations (Article 31(1)). We found no transitional relief from either test. The Data Hub becomes mandatory for importers for distance sales on 1 July 2028 (Article 285(2)), and Article 145 applies from the same date (Article 287(5)). An importer that registered for IOSS after 1 July 2026 cannot reach two years of IOSS use by then. Authorities also need time to decide applications, so the practical cut-off is earlier. Without Trust and Check status, that importer cannot itself operate a customs warehouse for distance sales, and so cannot use the lower handling fee (Article 20(4)). Plan for the standard fee.

For smaller businesses, authorities must take account of the specific characteristics of micro, small and medium-sized enterprises, and the Commission must issue guidelines to help them use AEO and Trust and Check status (Article 32).

8. Enforcement now has a price

For distance sales, Article 276 creates a ladder of penalties for systematic non-compliance:

Institutional summaries compress this to "up to 6%" (Council) or "at least 1% and up to 6%" (Parliament). Both are consistent with the tiers above. A failure is systematic where a substantive number of customs controls within one calendar month show non-compliance in a sufficiently representative number of cases (Article 276(2)). The Commission must define those thresholds by delegated act by 1 March 2028 (Articles 276(6) and 286(1)(b)). Until that delegated act is adopted, the quantitative thresholds remain undefined.

Member States also apply general penalties for other infringements of customs legislation, choosing among pecuniary charges, revocation or suspension of authorisations, confiscation and warnings. The Commission must evaluate by 21 September 2032 whether harmonised charges are needed (Article 275).

What to do now

These are starting points, not advice on your circumstances.

Sellers and platforms shipping to the EU from outside

• Count declaration lines, not parcels. Ask your broker or representative which declaration type (H1, H6 or H7) they will file, and model the EUR 3 duty on that line count. Model the handling fee per item once the amount is set.
• Check which duty basis applies to each flow: IOSS, postal, or neither. Article 2 of Regulation (EU) 2026/382 and the Commission guidance differ on the last.
• Confirm who is the importer for each sales flow, and how you will meet the EU establishment or representation requirement. Check the representative's AEO or Trust and Check status.
• Prepare product identifiers ahead of 1 November 2026. Decide which code applies to each product (C127, C128, C129 or Y081) and who will pass it to your declarant.
• Check whether your order and checkout systems can supply sale-level data within a day of payment, as IOSS users will need to from 1 July 2028.

Importers and exporters

• Map the customs data you hold, where it sits and who owns it. The Hub rewards data that is entered once and reused.
• Test your position against the Trust and Check criteria: two years of operations, three years of data, near-real-time reporting, records that can be shared and, for importers for distance sales, two years of registered and appropriate IOSS use. If you registered for IOSS after 1 July 2026, plan for the standard handling fee at Hub go-live.
• Treat every Hub submission as data that customs, tax, product-safety and market-surveillance authorities may use from 1 July 2028.

Logistics providers and customs brokers

• Review contracts for who supplies which data to whom, and for representation roles under Article 33.
• Before accepting an indirect-representation role, review authority, liability, indemnity, data-verification and termination clauses. Articles 33 and 183 make the representative jointly liable.

Everyone

• Diary the dates: 29 September and 1 November 2026, 1 July 2027, 21 September 2027, 1 December 2027 and 1 July 2028.

What we do not yet know

• The handling fee amount. Due from the Commission by 29 September 2026.
• Which duty applies outside IOSS and postal consignments. The wording of Article 2 and the Commission guidance differ (change 4).
• The data requirements for the Hub. Delegated and implementing acts for e-commerce are due by 1 July 2027, roughly a year before go-live (Article 286(2)(a)).
• What "systematic" means in practice. Due by 1 March 2028.
• Whether the 2028 date holds. The safety valves in Article 285(7) and Regulation (EU) 2026/382, Article 3(2) exist for a reason.
• How risk outputs will be explained and challenged. The Regulation ties the Hub's use of AI to the AI Act. How traders will see and question automated risk results will depend on the detail that follows.
• Who can use the customs warehouse route. Article 145(4) leaves the authorisation conditions to a delegated act. Until it is published, we cannot say whether a Trust and Check representative can open the route for an importer that does not yet qualify (change 7).
• Who may see which Hub data. The Commission will set the categories of data each authority may process by implementing act (Article 41(12)).
• SME support. The Commission's guidelines under Article 32(2) have no date yet.

What has changed since our May paper

The ECTM view

This section is ECTM analysis, not law.

The direction of travel we set out in May holds, and the final text strengthens it. Customs is becoming data-led. Sellers and platforms carry responsibility that used to fall on consumers and on chance. Trust and Check is a status earned from records. Penalties are calculated on import value.

Compliance is no longer about filing the right paperwork. It is about demonstrating the right governance.

The businesses that use the years to 2028 and 2034 to clean their data will meet the deadlines with choices. Those that wait will meet them with constraints.