驗證的權威：CBAM 如何建立碳證據的制度認可鏈

歐盟執委會於 2026 年 8 月 24 日發布 CBAM 驗證與認證指引，明確連結國家認證機構、合格驗證人、CBAM Registry、申報人與主管機關。EIA 012 指出，碳資訊要進入監管決策，不只必須技術正確，還必須經過制度承認的權威鏈。 CBAM 驗證指引把碳資料可信度推進到權威治理：數字正確只是其中一層，還必須由具備適當認證、權限與獨立性的主體，對特定設施、期間與報告形成受監管採用的結論。這使驗證不再是一個泛稱，而是一連串具有先後順序與適用範圍的制度狀態。 本期 Analysis 因而不把 CBAM 驗證人、認證機構與 Registry 所形成的制度權威鏈 視為單一技術或政策更新，而是把官方主錨點可證明的制度事實、SNN 的分析推論與仍待驗證的結果分層處理。讀者必須能看見主張從何而來、推論在哪裡開始，以及哪些結論目前不能由來源直接支持。 為使摘要能直接支援決策，本段同時回答五個問題：已發生什麼、由哪一第一方紀錄支持、影響透過什麼機制傳導、目前仍缺少哪些結果證據，以及下一個可推翻或強化判斷的檢查點。任何未被來源明示的因果關係都保留為編輯推論，不以肯定語氣包裝。

On 24 August 2026, the European Commission published guidance that connects National Accreditation Bodies, accredited verifiers, the CBAM Registry, declarants and competent authorities. EIA 012 argues that carbon information becomes usable in regulation only when technical credibility is joined to a recognised chain of authority. CBAM verifier guidance moves carbon-data credibility into authority governance. Numerical correctness is one layer; a conclusion must also be formed by an actor with the appropriate accreditation, access and independence for a specified installation, period and report before it can be used by the regulatory system. Verification becomes a sequence of institutional states with order and scope, not a generic label. This Analysis therefore does not treat the institutional authority chain formed by CBAM verifiers, accreditation bodies and the Registry as a self-contained technical or policy update. It separates the institutional facts supported by the official anchor, SNN editorial inference and outcomes that remain unverified. The reader should be able to see where the source ends, where interpretation begins and which conclusions the present evidence cannot support. To make the lead decision-ready, it answers five questions together: what has occurred, which first-party record supports it, through what mechanism the effect may travel, which outcome evidence is still missing, and what next observation could strengthen or overturn the judgement. Any causal relationship not stated by the source remains an editorial inference and is not converted into a factual claim through confident wording.

CBAM 正式期下，非歐盟設施營運者負責監測與計算嵌入排放；進口商若要在申報中使用實際排放資料，必須由依 CBAM 規則認證的獨立驗證人查證。認證、Registry 存取、個案驗證、報告簽發與申報用途，是相互連接但不同的制度環節。 非歐盟設施營運者產生嵌入排放資料，認證機構確認驗證人能力與公正性，主管機關與 Registry 管理參與權限，驗證人執行個案工作，申報人再把報告用於 CBAM 申報。各角色的責任互相依賴，但任何一方都不能單獨替代完整鏈條。 為了維持分析密度，制度背景必須同時標示規則制定者、執行者、資料擁有人、覆核者與受影響市場。這些角色可能由不同組織或部門承擔；文件發布、系統上線、企業採用與結果交付也不是同一證據狀態。 時間與權限也必須分開記錄：公告日不等於生效日，試點不等於普遍採用，技術規格不等於法律義務，企業自願導入也不等於監理核准。把這些節點放在同一時間軸，才能判斷一項制度變動何時真正進入資料、合約、投資或揭露流程。

In the definitive CBAM period, non-EU installation operators monitor and calculate embedded emissions. When importers use actual emissions, an independent verifier accredited under CBAM rules must verify the data. Accreditation, Registry access, case-specific verification, report issuance and declarant use are connected but distinct institutional stages. A non-EU installation operator produces embedded-emissions data. An accreditation body confirms verifier competence and impartiality. Authorities and the Registry manage participation and access. The verifier performs the case engagement, and the declarant uses the report for CBAM. The roles are interdependent, but no single actor can substitute for the complete chain. Institutional context must identify the rule setter, implementer, data owner, reviewer and affected market. Those roles may sit in different organisations or functions, and publication of a document, deployment of a system, enterprise adoption and delivery of an outcome are different evidence states. Time and authority must also be separated. An announcement date is not an effective date; a pilot is not general adoption; a technical specification is not a legal obligation; and voluntary enterprise use is not regulatory approval. Putting these events on one timeline shows when an institutional development actually enters data, contract, investment or disclosure processes and which actor is authorised to make that transition.

技術能力不等於 CBAM 認證，取得認證不等於 Registry 權限，取得權限也不表示某一設施與期間已完成驗證。若企業把這些狀態合併成一句「已驗證」，就可能無法證明誰在何種授權範圍內，對哪一組數據作成何種結論。 最常見的治理錯誤，是把技術能力、機構認證、Registry 註冊與個案報告混成一句已驗證。認證可能只涵蓋特定活動，Registry 權限可能尚未生效，個案報告也只對指定設施、產品與期間有效。若企業沒有保存這些邊界，後續申報可能引用不適用或過期的權威狀態。 上游證據若沒有穩定識別、形成時間、適用邊界與版本，最終輸出即使格式一致，覆核者仍可能無法重建形成過程。真正風險不是單一欄位缺失，而是錯誤主體、過期方法、推定關係或未核准版本在傳遞中被當成確定事實。 具體失效模式至少包括主體配對錯誤、資料人口不完整、邊界前後不一致、方法或係數未版本化、例外未留下理由、核准與發布時間倒置，以及下游重用時脫離原用途。每一種失效都可能讓合理的單筆資料，在彙總後形成無法防禦的結論。

Technical competence is not accreditation. Accreditation is not Registry permission. Registry permission does not prove that a particular installation and reporting period have been verified. Collapsing these states into a single verified label makes it difficult to show who reached which conclusion, under what authority, scope and evidence. A common governance error is to collapse technical competence, organisational accreditation, Registry registration and an engagement report into the phrase verified. Accreditation may cover only specified activities, Registry access may not yet be effective, and a report applies only to identified installations, products and periods. Without those boundaries, a declaration may cite an authority state that is inapplicable or expired. When upstream evidence lacks stable identity, formation time, applicable boundary and version, a standardised output may still be impossible to reconstruct. The material risk is not one missing field. It is the silent conversion of the wrong entity, an expired method, an inferred relationship or an unapproved version into an apparent fact as information moves downstream. Concrete failure modes include incorrect entity matching, an incomplete data population, inconsistent boundaries, unversioned methods or factors, exceptions without rationale, approval occurring after publication, and downstream reuse outside the original purpose. Each failure can turn a reasonable individual record into a conclusion that cannot be defended after aggregation, comparison or machine-assisted interpretation.

可執行的證據權威鏈依序連結技術能力、獨立與公正性、國家認證機構認證、主管機關確認與 Registry 存取、特定案件驗證、受控報告簽發、申報人使用及監管覆核。每一節點都應保存主體、授權範圍、設施、報告期間、版本、權限與狀態，避免把一次性的驗證結果當成永久資格。 證據權威鏈應為設施、營運者、產品、報導期間、驗證人法人與人員、認證範圍、Registry 身分、查證工作、發現、矯正與最終報告建立關聯。任何認證暫停、範圍調整、資料版本改變或驗證意見更新，都應觸發申報影響檢查並保留前後狀態。 可執行的控制單位應是受治理的證據物件：每項重要主張連接原始來源、計算或判斷方法、組織與時間邊界、責任人、控制狀態、例外、核准及版本。當任何元件改變時，系統保存差異與影響範圍，不以覆寫舊檔取代變更紀錄。 營運上可建立最小控制集：主張登錄、證據擁有人、來源快照、方法識別、適用期間、控制頻率、例外門檻、覆核與核准，以及允許的下游用途。高判斷或高財務影響項目採更嚴格的覆核層級；低風險資料則以自動化完整性檢查降低重工。

An operational evidence-authority chain links technical competence, independence and impartiality, accreditation by a National Accreditation Body, confirmation and Registry access, case-specific verification, controlled report issuance, declarant use and regulatory review. Each node should preserve actor identity, authority scope, installation, reporting period, version, permission and status. The evidence authority chain relates installations, operators, products, reporting periods, verifier legal entities and personnel, accreditation scope, Registry identity, engagement work, findings, remediation and the final report. Any suspension, scope change, data-version change or revised verification opinion triggers a declaration-impact check and retains the previous and subsequent states. The implementable control unit is a governed evidence object. Each material claim links to its primary source, calculation or judgement method, organisational and temporal boundary, accountable owner, control state, exception, approval and version. When any component changes, the system preserves the difference and affected uses instead of overwriting the earlier basis. A minimum operating control set includes a claim register, evidence owner, source snapshot, method identity, valid period, control frequency, exception threshold, review, approval and permitted downstream use. High-judgement or high-financial-impact items receive a stronger review tier. Lower-risk records use automated completeness and consistency checks so that governance effort is concentrated where a wrong claim would change a decision.

歐盟執委會指引說明，驗證人取得認證後須在兩個月內申請 Registry 註冊，且不得早於 2026 年 9 月 1 日；自 2027 年 1 月起，合格驗證人可在 Registry 簽發驗證報告。Regulation (EU) 2023/956 第 8 條、第 18 條與附件 VI，以及 Regulation (EU) 2025/2551、2025/2546，共同構成驗證、認證、監督與報告的法律及技術基礎。 歐盟指引與法規可以支持認證、Registry 存取、報告簽發及監督的法律與程序架構，也支持相關日期與角色安排。它們不能證明任何特定台灣驗證機構已獲 CBAM 資格，也不能保證一份其他制度下的查驗聲明可直接替代 CBAM 報告。 證據判讀以本期官方主錨點為起點，再以獨立第一方或具方法透明度的來源確認背景與邊界。來源能支持的是已發布的制度事實與明確數據；是否代表全面採用、因果改善或跨市場普遍有效，必須另有實作結果才能成立。 每一項關鍵句都應進入 claim ledger，標示其為官方事實、直接量測、估算、企業承諾、已交付結果或 SNN 編輯推論，並記錄來源所能支持的精確範圍。若兩筆來源衝突，保留衝突與處理理由；若資料尚未出現，明確標成待驗證，而不是以相近案例補成確定答案。

Commission guidance states that verifiers must register in the CBAM Registry within two months of accreditation and not before 1 September 2026. From January 2027, accredited verifiers can issue verification reports in the Registry. Regulation (EU) 2023/956, Delegated Regulation (EU) 2025/2551 and Implementing Regulation (EU) 2025/2546 provide the legal and technical basis for verification, accreditation, oversight and reporting. EU guidance and legislation support the legal and procedural architecture for accreditation, Registry access, report issuance and oversight, including relevant dates and roles. They do not establish that any particular Taiwan verifier is CBAM-qualified and do not mean that a verification statement prepared under another regime can replace a CBAM report. Evidence assessment begins with the official anchor and uses independent primary or method-transparent sources to test context and limits. The sources support stated institutional facts and explicit figures. Claims of comprehensive adoption, causal improvement or universal cross-market effectiveness require separate implementation evidence. Every material sentence should enter a claim ledger and be classified as official fact, direct measurement, estimate, corporate commitment, delivered outcome or SNN editorial inference. The ledger records the precise scope that each source supports. Conflicting evidence is retained with the resolution rationale; absent evidence is marked pending rather than filled with a convenient analogue from another entity, period or jurisdiction.

台灣出口供應鏈不能只準備排放總量與計算檔。實際排放資料能否被 CBAM 採用，還取決於設施身分、驗證人認證範圍、Registry 狀態、報告期間、證據可追溯性與申報關係是否持續相符。這會把驗證人資格與證據治理一併納入企業的跨境合規準備。 權威鏈的制度效果，是把可信度從單一文件屬性轉成可追溯的關係屬性。報告之所以可被採用，不只因為包含數字，而是能證明資料來源、驗證程序、執行者權限與監管環境在相關期間相互吻合。這也使企業必須同時治理資料品質與誰有權對資料作成結論。 這種資訊密度的目的不是增加篇幅，而是縮短主張到決策之間的查核距離。董事會、投資人、監理者與營運團隊應能辨識哪些內容是事實、估算、承諾、進度或結果，並在情境改變時更新判斷，而不是重新尋找散落的檔案與口頭說明。 責任分工因此必須落到決策權：資料擁有人維護來源，方法擁有人控制計算，業務單位說明使用情境，內控或確信人員測試可重建性，核准者承擔最終採用責任。例外若沒有到期日、補救人與影響範圍，就會從暫時處置變成永久的證據債務。

Taiwan export supply chains need more than emissions totals and calculation files. The usability of actual emissions also depends on installation identity, verifier accreditation scope, Registry status, reporting period, traceable evidence and continuity between the verified report and the declarant. Verifier authority therefore becomes part of cross-border evidence governance. The institutional effect of an authority chain is to make credibility a traceable relationship rather than a property of one document. A report is usable not only because it contains a number, but because the source data, verification process, actor authority and regulatory environment align for the relevant period. Companies must govern both data quality and the right to form conclusions from those data. The purpose of this information density is not length for its own sake. It is to shorten the verification distance between claim and decision. Boards, investors, regulators and operational teams should be able to distinguish fact, estimate, commitment, progress and outcome, then update the judgement when conditions change without reconstructing the case from scattered files and oral explanation. Accountability therefore attaches to decision rights. The data owner maintains the source, the method owner controls calculation, the business function defines the use case, internal control or assurance tests reproducibility, and the approver accepts responsibility for final use. An exception without an expiry date, remediation owner and impact scope stops being temporary treatment and becomes persistent evidence debt.

SNN 編輯分析：歐盟 CBAM 已影響台灣約 2,600 家業者，且以鋼鐵相關產品為大宗。鋼鐵、扣件、鋁、水泥及下游出口商面對的不只是碳排計算；設施身分、產品與批次、計算版本、驗證人認證、Registry 狀態、報告期間及申報人必須形成連續權威鏈，這已成為台灣出口競爭力。 台灣鋼鐵、扣件、鋁、水泥及下游出口商需要把工廠、產品、批次、排放方法與查驗工作連到歐盟進口申報關係。企業應向驗證服務提供者確認法人身分、認證範圍、Registry 狀態與適用期間，並保存歐洲進口商實際使用的報告版本；不能以台灣既有查驗經驗推定已符合 CBAM 權威要求。 對台灣市場的意義應沿實際傳導路徑判斷：國際制度或客戶要求先進入融資、採購、合約、供應商資料與確信流程，再影響台灣企業的系統與控制。這不等於外國規則自動成為台灣法律義務；本地企業要做的是辨識適用情境、保留跨語言對應並建立可授權覆核的證據鏈。 台灣企業可把傳導測試落在具體物件：公司與法律主體、廠區、產品、批次、供應商、合約、融資工具及揭露欄位。中英文名稱、內外部分類與不同框架之間應連到同一主張識別，同時保留商業機密、個資與權限邊界，避免可追溯被誤解為全面公開。

SNN editorial analysis: EU CBAM affects around 2,600 Taiwan operators, led by steel-related products. Steel, fastener, aluminium, cement and downstream exporters need continuity across installation identity, product and batch, calculation version, verifier accreditation, Registry status, reporting period and declarant. This evidence-authority chain is part of Taiwan export competitiveness. Taiwan steel, fastener, aluminium, cement and downstream exporters need to connect plants, products, batches, emissions methods and verification work to the EU import declaration relationship. They should confirm the service provider's legal identity, accreditation scope, Registry status and valid period, and retain the report version actually used by the European importer. Existing Taiwan verification experience cannot be assumed to satisfy CBAM authority requirements. For Taiwan, relevance should be traced through an actual transmission path. An international rule or customer requirement first enters finance, procurement, contract, supplier-data and assurance processes, then changes local systems and controls. It does not automatically become Taiwan law. Companies need to identify the applicable scenario, preserve bilingual mappings and make the evidence chain reviewable under controlled access. Taiwan companies can perform the transmission test on concrete objects: the company and legal entity, facility, product, batch, supplier, contract, financing instrument and disclosure field. Chinese and English names, internal and external classifications and different reporting frameworks should resolve to the same claim identity. Traceability must still preserve commercial confidentiality, personal data and access boundaries; it does not require unrestricted publication.

後續應追蹤 2026 年 9 月 1 日起的 Registry 註冊、各國認證機構的服務能力、2027 年 1 月起的報告簽發、境外驗證機構適用性及主管機關覆核。企業可及早建立同時保存資料品質、來源、版本與驗證權威的 Pre-Disclosure Evidence Infrastructure。 後續應追蹤 Registry 註冊、各國認證機構能力、2027 年報告簽發及境外服務模式。低後悔行動是建立 verifier authority register，對每一候選驗證人保存認證文件、範圍、有效期、Registry 狀態、利益衝突與個案資格，並在簽約與報告使用前分別覆核。 後續追蹤應分開最終文件、技術指引、採用範圍、執行控制、監督活動與可觀察結果。現階段的低後悔行動，是挑選一項高風險主張做端到端重建測試，記錄缺少的身分、來源、方法、責任與版本；這是治理準備，不是合規保證或結果預測。 監測不只依日曆，而應由事件觸發：最終規則發布、技術指引變更、適用範圍擴大、主管機關執法、企業採用數據或實際成果出現時，都建立新版本並重評原判斷。舊結論不刪除，而是標示當時依據、被何種新證據修正，以及哪些決策需要重新檢視。

Next steps include Registry enrolment from 1 September 2026, National Accreditation Body capacity, report issuance from January 2027, the applicability of non-EU verification firms and competent-authority review. Enterprises should build Pre-Disclosure Evidence Infrastructure that preserves both evidence quality and the authority attached to it. Future evidence should follow Registry registration, national accreditation capacity, report issuance from 2027 and cross-border service models. A low-regret action is a verifier authority register that preserves accreditation, scope, validity, Registry state, conflict status and engagement eligibility for every candidate, with separate review before contracting and before report use. Future monitoring should separate final text, technical guidance, adoption scope, operating controls, supervision and observable outcomes. A low-regret step is to select one high-risk claim for an end-to-end reconstruction test and record missing identity, source, method, accountability and version. That is governance preparation, not a compliance guarantee or forecast of results. Monitoring should be event-triggered as well as calendar-based. A final rule, amended technical guidance, expanded scope, supervisory action, adoption data or observed outcome creates a new version and a reassessment of the earlier judgement. The prior conclusion is not erased. It retains its original basis, identifies the new evidence that changed it and states which decisions or downstream uses now require review.