International · 7 min read
The European regulatory wall: what CBAM, EUDR, and GPSR mean for Vietnamese exporters
Stijn Belmans · certified EADPPPublished · Last updated
Short answer
Thanks to the EVFTA, tariffs on Vietnamese exports to the EU are gone, but in 2026 and 2027, new EU regulations will apply: CBAM for carbon, EUDR against deforestation, and GDPR for product safety. These rules don’t ask what your product costs, but what it is: origin, carbon footprint, and who is legally responsible. European buyers are already requesting this documentation.
The EVFTA has delivered on its promise. Five years after its launch, cumulative trade between Vietnam and the EU exceeded $298 billion, bilateral trade approached $74 billion in 2025, and Vietnamese exports to the bloc reached $56.2 billion. Between 2019 and 2024, trade with the EU grew by 47%. Today, Vietnam is the EU’s largest trading partner within ASEAN.
By 2030, the EU will have eliminated import duties on 99.2% of tariff lines for Vietnamese exports.
The import duties are disappearing. And then comes the part that gets far less attention: the paperwork takes their place.
A wave of European regulations is coming in 2026 and 2027, and together they do something the old tariff system never did. They don’t ask what your product costs. They ask what your product is — where the raw materials come from, how much carbon is in it, who is legally responsible, and whether you have proof of that.
If you can’t answer that question, your tax advantage is irrelevant. You won’t reach the point where it applies.
What exactly is coming
CBAM — the carbon border tax
On January 1, 2026, the Carbon Border Adjustment Mechanism moved from its reporting phase to the final regime. The carbon cost is now calculated based on verified emission data — though the actual purchase and surrender of CBAM certificates begins on February 1, 2027, for emissions embedded in imports from 2026.
Read the timing carefully, because that’s where the trap lies. The cost applies to what you ship in 2026. The invoice arrives in 2027. Your European importer is already factoring that into the contract price.
For Vietnamese manufacturers, the requirement isn’t a certificate. It’s information: direct emissions from your production process, and indirect emissions from the electricity used for it. Both, per product, verified.
Cement, iron and steel, aluminum, fertilizers, hydrogen, and electricity are included. If you supply components in one of these chains, you’ll be asked for copper figures even if you’re not the declarant. One useful note from the CBAM Omnibus Regulation of October 2025: importers with a net annual import below 50 tons of CBAM goods are fully exempt. If your European buyers are small, check this threshold before you start building.
EUDR — the Deforestation Regulation
The EUDR has been delayed twice, and the data you recorded last year no longer applies. Under Regulation 2025/2650, adopted in December 2025, the deadlines are now December 30, 2026 for medium and large market participants and traders, and June 30, 2027 for micro and small enterprises.
Don’t read this as breathing room. Read it as the deadline you can actually meet — because the previous timeline was unachievable for most chains, and that’s exactly why it was moved.
What’s affected: wood, coffee, cocoa, rubber, soy, palm oil, beef, and derived products. This hits some of Vietnam’s largest export categories head-on — wood and wood products, coffee, and rubber.
The EUDR requires geolocation data of the plots where the raw material was produced, along with a due diligence statement that the goods are deforestation-free and legally produced. Plot coordinates. No supplier declaration, no federation certificate — coordinates, traceable throughout the chain.
For an exporter buying coffee through three layers of traders, this isn’t a compliance task. It’s a redesign of the supply chain, and eighteen months is less time than it sounds.
GPSR, PPWR, and the Digital Product Passport
Additionally, the General Product Safety Regulation, the Packaging and Packaging Waste Regulation (PPWR), and the Digital Product Passport raise the bar for what must accompany the goods.
The GPSR requires a designated person based in the EU for products sold to European consumers — a named entity with an address, on the product or packaging. The PPWR changes what your packaging may contain and how you must indicate that. The Digital Product Passport will require structured, machine-readable product data linked directly to the item.
See the pattern? Each of these rules turns a physical export into a data export. Your product now leaves with a dossier, and that dossier must be accurate.
What this looks like from the buyer’s side
This is what’s really happening, and it’s happening sooner than most exporters expect.
A European importer’s compliance team sends a questionnaire before signing. It asks for your emission methodology, traceability documentation, your European Responsible Person, your GDPR data processing, and your supplier list.
You have two weeks to respond. Your competitor in Bangladesh or Turkey answers in three days, with a dossier built last year.
The tender doesn’t mention ‘rejected on compliance.’ It says nothing at all. You simply won’t be selected, and you’ll never know why.
This is the mechanism that costs you money. Not fines. Lost tenders you didn’t know you were in.
What we would do first
You can’t solve everything at once, and you shouldn’t try. Order matters more than speed.
1. Determine what truly applies to you. Most exporters both over- and underestimate their exposure at the same time. A company convinced that CBAM will ruin them turns out to be out of scope, while the same company is fully subject to the EUDR and hadn’t even looked into it. Half a day of careful scoping saves months of work in the wrong direction.
2. Ask your three largest European customers what they will require, and when. It’s free, it takes one email, and almost no one does it. Your buyers are ahead of you, as their own obligations flow down to you. They’ll tell you exactly what they need — and asking positions you immediately as the supplier who has it under control.
3. Find your data before you build the report. Emissions per product, parcel coordinates, material composition, packaging weights. Most of this already exists somewhere in your company: in a spreadsheet, on a form, or in someone’s head. Finding it is a different task than reporting, and it’s the one that consumes time.
4. Assign your European roles. A European responsible person under the GDPR. An EU representative under Article 27 of the GDPR if you process European personal data. Small, cost-effective appointments with a fixed annual cost — and leaving them open is a visible, easily verifiable shortcoming on every checklist.
5. Build the dossier once and reuse it forever. The highest-impact intervention is a standing compliance package you can send within 48 hours of any buyer’s request: scope, methodology, traceability approach, assigned roles, and a privacy summary. Build it once. Update it quarterly. That turns a three-week panic into an attachment.
The fair version
None of this is cheap or quick, and anyone telling you there’s a plugin for it is selling you something.
But it’s good to understand what this actually is. This isn’t a tax on Vietnamese exporters. It’s a filter. Whether Vietnam can retain and expand its share of the European market will depend on supply chain management, data transparency, sustainability standards, and traceability of product origin — and the exporters who act first will capture market share from those who wait, within the exact same tariff regime, with the same products.
Those who treat 2026 as an administrative burden will spend the year defending their position. Those who treat it as a qualification will spend it taking over someone else’s.
Where we come in
Chuyenso is a Belgian company. We work from within the European market with companies from outside, focusing on exactly this: what Europe will ask for, what you already have, and what needs to be built.
Our founder has fifteen years of entrepreneurship experience, over a hundred clients in strategy, development, and data, and is certified EADPP under the European GDPR framework. We are neither a certification body nor lawyers — we are the people who figure out what needs to be done, in what order, and what it’s worth.
EU Scan — three sessions over three weeks. Week one: your actual exposure to CBAM, EUDR, GPSR, GDPR, and the rest. Week two: gaps ranked by risk and revenue at stake. Week three: a 90-day plan with owners and budget, plus a compliance summary you can send to a European buyer tomorrow.
We also work on-site — preferably so, as a day in the factory reveals things a video call never will. On-site days are available during announced travel periods in Ho Chi Minh City and Hanoi.
Start with a free 25-minute introduction if you first want to know whether this applies to you, before committing to anything.
Chuyenso — literally: digital transformation. We help businesses outside Europe become Europe-ready: legally, technically, and commercially.
Sources: EU Green Rules Reshape the Future of Vietnamese Exports (VnEconomy)
· Challenges for Vietnam’s exports when the EU CBAM is implemented (VCCI WTO Center)
· EVFTA Turns Five (EuroCham Vietnam)
· EU Adopts CBAM Omnibus Regulation (EY) · Delay until December 2026 — EUDR (European Commission, Access2Markets)