The European rule wall: what CBAM, EUDR, and GDPR mean for Vietnamese exporters

The EVFTA has done what it was supposed to do. Five years after its launch, cumulative trade between Vietnam and the EU has exceeded $298 billion; two-way trade approached $74 billion in 2025; and Vietnamese exports to the bloc reached $56.2 billion. Between 2019 and 2024, trade with the EU grew by 47%. Vietnam is now the EU’s largest trading partner within ASEAN.

By 2030, the EU had eliminated import duties on 99.2% of the tariff lines for Vietnamese exports.

So the import duties will disappear. And then comes the part that gets much less attention: the paperwork takes its place.

A stack of European regulations lands in 2026 and 2027, and together they do something the old tariff system never did. It doesn't ask the cost of your product. It asks for your product's is — where the raw material comes from, how much carbon it contains, who is legally responsible for it, and whether you have proof of that.

If you can't answer those questions, then your rate advantage is irrelevant. You don't reach the point where it applies.


What exactly is coming

CBAM — the Carbon Border Adjustment Mechanism

On January 1, 2026, the Carbon Border Adjustment Mechanism moved from its reporting phase into the definitive regime. The carbon cost is now calculated based on verified emissions data — although the actual purchase and surrender of CBAM certificates will not start until February 1, 2027, for emissions contained in imports from 2026.

Read that timing carefully, because that's where the catch is. The cost applies to what you ship in 2026. The invoice will be issued in 2027.Your European importer is already factoring that into the contract price.

For Vietnamese producers, the requirement is not a certificate. It is information: direct emissions from your production process, and indirect emissions from the electricity you use for that purpose. Both are verified for each product.

Cement, iron and steel, aluminum, fertilizers, hydrogen, and electricity fall under it. If you supply components in one of those chains, you will be charged copper unless you are the declarant. One useful notice from the CBAM Omnibus Regulation of October 2025: importers with a net annual import below 50 metric tons CBAM goods are fully exempt. If your European buyers are small, check that threshold before you build anything.

EUDR — the Deforestation Regulation

The EUDR has already been postponed twice, and the dates you wrote down last year are no longer correct. Under Regulation 2025/2650, adopted in December 2025, the following now applies: December 30, 2026, for medium-sized and large market participants and traders, and June 30, 2027, for micro and small enterprises.

Don't think of that as breathing room. Think of it as the deadline you can actually meet—because the previous schedule wasn't feasible for most chains, and that's exactly why it was pushed back.

What falls under this: wood, coffee, cocoa, rubber, soy, palm oil, cattle, and derived products. This hits a number of Vietnam's largest export categories right in the heart — wood and wood products, coffee, and rubber.

The EUDR requires geographical location data of the plots where the raw material was produced, plus a declaration of due diligence stating that the goods were produced deforestation-free and legally. Plot coordinates. No supplier declaration, no certificate from a federation — coordinates, traceable throughout the chain.

For an exporter who purchases coffee through three tiers of buyers, that’s not a compliance task. It’s a redesign of the supply chain, and eighteen months is less time than it sounds.

GPSR, PPWR, and the Digital Product Passport

In addition, the General Product Safety Regulation, the Packaging Regulation (PPWR), and the Digital Product Passport raise the bar for what must accompany the goods.

The GPSR requires a responsible person established in the EU For products sold to European consumers—a designated entity with an address, listed on the product or its packaging. The PPWR changes what your packaging is allowed to contain and how you must indicate that information. The Digital Product Passport will require structured, machine-readable product data linked to the item itself.

Do you see the pattern? Each of those lines converts a physical export into a data export. Your product is now being shipped with documentation, and that documentation must be accurate.


What this looks like from the buyer's perspective

This is what's really happening, and it's happening sooner than most exporters expect.

The compliance team of a European importer sends a questionnaire before the contract is signed. It asks about your emissions methodology, your traceability documentation, your European Data Protection Officer, your data processing under the GDPR, and your list of suppliers.

You have two weeks to respond. Your competitor in Bangladesh or Turkey will respond in three days, with a proposal that was put together last year.

Nowhere in the request for proposals does it say “rejected for non-compliance.” It doesn’t say anything at all. You’re simply no longer selected, and you never find out why.

That's the mechanism by which excessive regulation costs you money. Not fines. Lost bids you didn't even know you were in.


What we would do first

You can't solve all of this at once, and you shouldn't even try. The order in which you tackle these issues is more important than the speed at which you do so.

1. Find out what really applies to you. Most exporters simultaneously overestimate and underestimate their exposure. A company that is convinced CBAM will ruin them turns out to be out of scope; that same company is fully involved in the EUDR and hadn't looked into it. Half a day of proper scoping saves months of work in the wrong direction.

2. Ask your three largest European clients what they will require, and when. It's free, it costs one email, and almost no one does it. Your buyers are ahead of you because their own obligations flow through to you. They will tell you exactly what they need—and asking the question immediately positions you as the supplier in control.

3. Find your data before you build the report. Emissions per product, plot coordinates, material composition, packaging weights. Most of this exists somewhere in the company: in a spreadsheet, on a form, in someone's head. Finding it is a different job than reporting it, and it's the job that eats up time.

4. Assume your European roles. A European responsible person under GDPR. An EU representative under Article 27 of GDPR if you process European personal data. Small, inexpensive appointments with a fixed annual cost—and leaving them open is a visible, easily verifiable deficiency on any questionnaire.

5. Build the file once and reuse it forever. The intervention with the highest return on investment is a standing compliance package that you can send within 48 hours of any buyer request: scope, methodology, traceability approach, assigned roles, privacy summary. Build it once. Update quarterly. This turns a three-week panic into an appendix.


The honest version

None of this is cheap or fast, and anyone who tells you there's a plugin for it is selling you something.

But it's good to know what this is. This is not a tax on Vietnamese exporters. It is a filter. Of Vietnam's European market share can be maintained and expanded will depend on supply chain management, data transparency, sustainability standards, and control over product origin — and exporters who get there first will take market share from those who wait, under the exact same tariff regime, with the same products.

As it is treated as an administrative burden in 2026, the year is spent defending its position. Whoever treats it as a qualification spends it on taking over someone else's.


Where we come in handy

Chuyenso is a Belgian company. We work from within the European market with companies from outside it, on precisely this: what Europe will ask for, what you already have, and what needs to be built.

Our founder has fifteen years of entrepreneurship experience, over a hundred clients in strategy, development, and data, and is a certified EADPP under the European GDPR framework. We are not a certification body, nor are we lawyers — we are the people who figure out what needs to be done, in what order, and what it's worth.

Europe scan — three sessions over three weeks. Week one: your actual exposure to CBAM, EUDR, GPSR, GDPR, and the rest. Week two: gaps ranked by risk and by revenue at stake. Week three: a 90-day plan with owners and budget, plus a compliance summary you can send to a European buyer tomorrow.

We also work on-site. Preferably, even — a day in the factory teaches you things a video call never will. On-site days are available during announced travel periods in Ho Chi Minh City and Hanoi.

Start with a free 25-minute introductory session if you'd like to find out if this applies to you before spending anything.

Book a session


Chuyenso — literally: digital transformation. We help companies outside of Europe to become Europe-ready: legally, technically, and commercially.

Sources: EU Green Rules Reshape Future of Vietnamese Exports (VnEconomy) 
· Challenges for Vietnam's Exports with the EU CBAM Implementation (VCCI WTO Center) 
· EVFTA Turns Five (EuroCham Vietnam) 
· EU Adopts CBAM Omnibus Regulation (EY) · Delay until December 2026

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top