The most consequential change to US import data requirements in a generation is now formally under way, and the analytical call here is that it will not arrive as a rule. Signals point to the substance of CBP’s “Heightened Import Disclosures for Supply Chain Visibility” proposal binding cross-border sellers well before any regulation from that docket takes legal effect, most likely through general notices, voluntary test programs and commercial contract terms rather than the Code of Federal Regulations. The specific prediction: no notice of proposed rulemaking under RIN 1685-AA47 is likely to publish before June 30, 2027, and no binding rule from that docket is likely to be in force before the 2027 US holiday peak. The pattern in CBP’s own recent conduct suggests the data demands land anyway, on a faster and less visible track.
In short
- The prediction: no NPRM under RIN 1685-AA47 before June 30, 2027, and no binding rule from that docket in force before November 1, 2027, while the same data requirements start reaching importers through faster instruments.
- Signal 1: the September 2, 2026 advance notice contains 64 numbered questions and no draft regulatory text, which is the earliest stage of the rulemaking pipeline rather than the last.
- Signal 2: CBP has already moved on party-identity data without rulemaking, via an August 19, 2026 general notice that authorizes voiding importer of record numbers from September 18, 2026.
- Signal 3: the agency’s preferred delivery rails are voluntary and administrative, including the Global Business Identifier test running since December 2022 and the CTPAT minimum security criteria, neither of which requires notice and comment.
- What could break it: an interim final rule issued under national-security framing, or a statutory mandate from Congress, either of which would compress the timeline sharply.
Why this matters now
Cross-border commerce spent 2025 and 2026 absorbing a rebuilt tariff architecture. The next phase is not about rates. It is about identity: who made the goods, who shipped them, who sold them, and what those parties told their own customs authority before the container left.
That shift is expensive in a different way. Tariffs are a cash cost that flows through landed cost models and can be repriced. Data obligations are a systems cost that lands on brokers, ERP integrations and supplier contracts, and they do not scale down neatly for small sellers.
The proposal now open for comment would reach further into private supply chains than any US customs data initiative since the Customs Modernization Act of 1993. Our news desk covered the mechanics when the notice landed, in CBP’s heightened import disclosures and the December 1 comment deadline. The question this piece takes up is different: not what the agency proposed, but through which instrument the requirements are likely to actually arrive, and when.
That distinction decides whether a mid-market importer should be budgeting compliance spend for fiscal 2027 or fiscal 2029. The evidence suggests the answer is closer to the former than the rulemaking calendar implies.
Signal 1: an advance notice with 64 questions and no rule text
CBP published the notice in the Federal Register on September 2, 2026, at 91 FR 56408 to 56414, under docket USCBP-2026-1058 and RIN 1685-AA47. It contemplates amendments to 19 CFR parts 141, 142, 143 and 163, and comments are due on or before December 1, 2026. Its stated action line is “advance notice of proposed rulemaking,” and that phrase carries more predictive weight than the substance underneath it.
An advance notice is the stage at which an agency does not yet know what it wants to require. The document itself concedes the point: the comments received “will be used, potentially, to draft a Notice of Proposed Rulemaking.” Seven Federal Register pages carry 64 numbered questions, running from whether importers should submit foreign export declarations at all (Q1) through what the manufacturer identification code should be replaced with (Q24 to Q33) to how supply chain tracing technology should integrate with existing trade systems (Q46 to Q55).
Read the questions closely and the timeline problem becomes visible. CBP asks whether foreign export documentation should be an entry requirement or a recordkeeping requirement, whether submission should be randomized, who should be the responsible party, how long records should be retained, and how documents in foreign languages should be handled. Those are not refinements. They are the load-bearing design choices of the rule.
The notice also asks, for each proposal, whether requirements should be phased in by entry type, commodity, country or mode of transportation; whether different timelines should apply to small entities, foreign importers, CTPAT participants or high-volume filers; and, tellingly, “whether any of the proposals are suited to voluntary test programs.” An agency that expects to move fast through regulation does not ask which parts it could run as a test instead.
The substance of the first workstream is worth stating plainly, because it is unusual. CBP is asking whether importers should hand over the paperwork their suppliers filed with a foreign government: export declarations, commercial invoices showing the value declared abroad, packing lists, certificates of origin, export licenses and the transport documents attached to the foreign export manifest. The stated purpose is reconciliation, specifically detecting “dual-invoicing” where the value declared on export does not match the value declared on import.
That is a coherent enforcement idea and a difficult regulatory one. It makes a US importer responsible for obtaining, authenticating and possibly translating a document generated by a third party in another jurisdiction, which is why the notice devotes questions Q12 through Q18 to authenticity, language and lead times. Those are not questions an agency answers in a single drafting cycle.
One more structural detail matters. The proposal spans three genuinely separate workstreams: foreign export documentation, party identification, and traceability technology plus CTPAT criteria. Each has different legal authority, different affected populations and different cost profiles, which usually means they do not travel through rulemaking as one package.
Signal 2: CBP already moved on party data without a rulemaking
Two weeks before the advance notice, the same agency implementing the same executive order took binding action on the same subject matter, and used no rulemaking to do it.
On August 19, 2026, CBP published a general notice at 91 FR 53627, document 2026-16911, stating that it was “taking initial steps to implement Executive Order 14411” by verifying the accuracy of information that importers of record supply on CBP Form 5106. The consequence is blunt: inaccurate or incomplete information “may result in immediate voiding of IOR numbers and other enforcement actions.” A voided number is invalid for entering merchandise. Our coverage of the operational fallout is in CBP voids importer of record numbers from September 18.
Note what that instrument is and is not. It is not a proposed rule, it carried no comment period, and it reached effect roughly 30 days after publication. It nonetheless does much of what the advance notice’s second workstream contemplates: it forces accurate identification of the party standing behind an import.
The timing is the tell. If CBP believed the rulemaking track could deliver party-identity discipline on a useful horizon, the August notice would have been unnecessary. Its existence suggests the agency treats the rulemaking as the long-horizon instrument and the notice as the operative one.
The August notice was not isolated either. In the same four-week window CBP published a final rule extending Automated Commercial Environment export manifest requirements to rail cargo, declared four customs-enforcement areas in near-shore waters, and noticed a meeting of the Commercial Customs Operations Advisory Committee. Executive Order 14411 also required revised penalty mitigation standards with a floor, effective at the start of September 2026. That is a great deal of institutional motion, none of it through the docket now open for comment.
Signal 3: the voluntary rails are where the data actually lands
The third signal is the least discussed and probably the most predictive. CBP has a working method for collecting new data elements from the trade, and it is not notice-and-comment rulemaking. It is the National Customs Automation Program test, authorized by the Customs Modernization Act, run by general notice.
The Global Business Identifier test is the live example. CBP began consulting on it in 2021, announced the test at 87 FR 74157 on December 2, 2022, and modified it again at 90 FR 38479 on August 8, 2025. The test lets importers and brokers transmit up to four private-sector entity identifiers, the D-U-N-S number, the Global Location Number, the Legal Entity Identifier and the Altana ID, to identify the manufacturer, shipper or seller, with the exporter, distributor and packager available as options.
That is close to the identity architecture the advance notice describes. It has been operating for nearly four years without a single line of new regulation, and the advance notice devotes questions Q37 to Q45 to whether it should be expanded or made mandatory.
The CTPAT channel is similar. Because the Customs Trade Partnership Against Terrorism is a voluntary program authorized by the SAFE Port Act of 2006, CBP can revise its minimum security criteria administratively and price the change in benefits rather than penalties. Questions Q56 to Q61 ask whether all partners should be required to use supply chain tracing technology, whether they should expose that technology to CBP, and whether the criteria should restrict “covered logistics platforms,” with the Chinese state-linked LOGINK system named directly. Roughly 70% of CTPAT membership is small businesses, so a criteria change reaches deep into the mid-market without touching the CFR.
What the pattern suggests
Put the three signals together and a coherent forecast emerges. The rulemaking is real, and it is slow. The requirements are real, and they are fast. They are simply travelling on different tracks.
The base case runs roughly like this. Comments close December 1, 2026. CBP spends most of 2027 processing them, likely alongside COAC working-group sessions. A proposed rule, if one comes, plausibly surfaces in late 2027 or 2028, with a final rule and implementation period behind it. Nothing in that sequence binds an importer before the 2027 holiday peak.
Meanwhile the operative pressure builds through the other channels: further executive-order implementation notices in the style of the August 19 action, likely expansion or partial mandating of the Global Business Identifier test, plausible revision of CTPAT criteria to cover data integrity and platform restrictions, and, most immediately, brokers and marketplaces demanding the underlying documents from sellers as a condition of service.
That last point deserves emphasis because it is where most sellers will first feel it. A customs broker facing voided IOR numbers and a 50% penalty floor has every incentive to demand factory-level identity and export declarations from clients before CBP requires it. Compliance migrates into commercial terms ahead of law.
It is worth pricing the alternatives rather than asserting one path. The scenario weights below reflect the base rates in customs rulemaking and the specific conduct observed over the past four weeks.
| Scenario | Rough weight | What it looks like | Early tell |
|---|---|---|---|
| Slow rule, fast side channels (base case) | ~60% | No NPRM before mid-2027; obligations arrive via notices, tests, CTPAT criteria and broker contract terms | Another Executive Order 14411 general notice lands before spring 2027 |
| Carve-out acceleration | ~20% | An interim final rule for designated high-risk product categories, leaving the general architecture unfinished | A national-security designation list appears in a separate notice |
| Statutory leapfrog | ~10% | Congress legislates data elements with a compliance date, and CBP implements to statute | Trade enforcement legislation clears the Senate with data provisions intact |
| Program drift | ~10% | Tariff base narrows further, urgency fades, docket goes quiet after the comment close | No follow-on CBP activity in the two quarters after December 1, 2026 |
| Signal | Date and source | What it implies | Read confidence |
|---|---|---|---|
| Advance notice, 64 open questions, no draft text | September 2, 2026, 91 FR 56408, docket USCBP-2026-1058 | Rule design is unsettled; NPRM is at least a year out on base rates | High |
| Form 5106 verification and IOR voiding | August 19, 2026, 91 FR 53627, effective September 18, 2026 | CBP will use general notices for binding party-data discipline | High |
| GBI test still running, expansion questions posed | 87 FR 74157 (2022), modified 90 FR 38479 (2025) | Identity data collection scales through tests, not rules | Medium-high |
| CTPAT criteria questions on tracing and platforms | Questions Q56 to Q61 of the advance notice | Administrative criteria change is available without rulemaking | Medium |
| ACE rail export manifest final rule | August 26, 2026 | Data mandates ship module by module, not as one framework | Medium |
Wider context: the agency’s own systems are the binding constraint
There is a practical reason to doubt that any near-term rule could demand large new transmission fields at entry: CBP’s systems program is currently slipping, not accelerating.
The Consolidated Administration and Processing of Entries system, CBP’s refund and entry-processing build, has had its third phase postponed with no replacement date, stranding roughly $11.4 billion in refunds tied to finally liquidated entries. We covered the sequence in the CAPE Phase 3 postponement. An agency that cannot ship the refund phase of its own platform on schedule is unlikely to add mandatory manufacturer, shipper and seller identifiers to every entry filing within twelve months.
The advance notice implicitly acknowledges this. Question Q49 asks how traceability technologies could be “integrated with existing trade data systems, including the Automated Commercial Environment and relevant Partner Government Agency data exchanges,” which is the question of an agency assessing capacity rather than one scheduling a launch.
There is a deeper structural point here about how US customs law has worked since 1993. The Customs Modernization Act traded presentation of documents at entry for a broader right to demand records afterwards, which is the “informed compliance and shared responsibility” bargain the advance notice cites. That design means CBP can expand what importers must be able to produce without expanding what they must transmit, and expanding the first is procedurally far cheaper than expanding the second.
Several of the notice’s questions read as though the agency is testing exactly that route. Q2 asks whether foreign export documentation should be transmitted at entry “or should foreign export documentation be a recordkeeping requirement,” and Q3 asks whether submission should be randomized. A recordkeeping-plus-sampling design imposes real obligations while avoiding a rebuild of the entry filing itself.
The precedent record points the same way. CBP’s history with framework-scale trade modernization is a history of long horizons, and its history with executive-order-driven change is the opposite.
| Program | First public step | Status as of September 2026 | Elapsed |
|---|---|---|---|
| 21st Century Customs Framework | Public meeting and comment request, December 21, 2018 | No comprehensive rule | About 7.7 years |
| Global Business Identifier | Information collection notice, October 6, 2021; test notice December 2, 2022 | Still a voluntary test | About 3.8–4.9 years |
| Section 321 Entry Type 86 | Test notice, August 13, 2019 | Superseded by executive action, not by the 2025 proposed rules | About 6 years |
| Low-value shipment rulemaking | Two proposed rules, January 2025 | Overtaken by executive orders before finalization | About 20 months |
| Mail de minimis suspension | Interim final rule, June 24, 2026 | In force on publication | Immediate |
Four of those five rows support the slow-rulemaking reading. The fifth is the reason for the caveat section below.
Implications for retailers, marketplaces and brokers
For importers of record, the near-term exposure is not the rule. It is the identity data already on file. The August notice put existing CBP Form 5106 records inside the review population, which means accounts opened years ago are in scope, and the sanction reaches the ability to enter goods at all.
The practical sequence for a mid-market importer looks like this. Reconcile Form 5106 details first, because that is live. Then map which parties in the chain could produce a foreign export declaration on request, since the advance notice treats that as a recordkeeping question and recordkeeping obligations can attach quickly. A working primer on the underlying roles sits in our explainer on importer of record status and customs bonds.
For marketplaces the interesting item is Question Q33, which asks whether a platform that facilitated the sale of imported merchandise should be identified to CBP. That is the same conceptual move the European Union has already made in its customs overhaul, which we analyzed in the EU reform making platforms the importer of record. Convergence between the two regimes now looks more likely than divergence, even if the US arrives later and by a different instrument.
For customs brokers and freight intermediaries, the commercial opportunity and the liability arrive together. Brokers are the parties best positioned to collect entity identifiers and export documents, and they are also the parties who file the data and carry reasonable-care exposure when it is wrong.
Timing matters more than magnitude for budget owners. A compliance program built for a 2028 rule and started in 2028 will be late for the obligations that actually arrive in 2027, because those obligations will come from counterparties rather than from the register. The cheapest hedge is documentation capability, which has value under every scenario in the table above.
For technology vendors, the signal is that identifier resolution and document capture are the near-term products, not blockchain-style traceability. The advance notice asks 10 questions about tracing technology and does not endorse any of them, whereas the identity questions map onto tooling that already exists.
Caveats: what could go wrong
The strongest counter-argument to this call is the interim final rule. CBP used exactly that instrument on June 24, 2026 for mail shipments under the de minimis suspension, and it took effect on publication. The agency’s cited authority under 19 U.S.C. 1624 is broad, and questions Q19 to Q23 of the advance notice contemplate letting the Secretary designate categories of imports posing “an unusually high or grave risk” to national security, with documentation required as a condition of entry. National-security framing is precisely the argument that supports bypassing ordinary notice and comment. If that route is taken for a designated product category, the timing prediction fails for that category, though the broader disclosure architecture would still be unfinished.
The second counter-signal is Congress. Trade-enforcement legislation has been moving, including a trade crimes bill that cleared the House, covered in our report on the House vote and the unfunded task force. A statutory data mandate with a compliance date would leapfrog the rulemaking entirely, and statutes are not constrained by the Administrative Procedure Act timeline.
The third is a change in the underlying incentive. The rationale for this program is transshipment and duty evasion, which only matters at scale while tariff differentials are wide. Litigation has already reshaped the tariff base once in 2026, and further narrowing would reduce both the revenue argument and the political urgency behind the disclosure build.
The fourth is simpler: comment volume could resolve the design questions faster than expected. If the December 1 docket produces broad industry consensus on, say, using existing entity identifiers rather than inventing new ones, CBP could move to a narrow proposed rule quickly. A narrow rule is easier to write and easier to defend than a framework rule, and it is the scenario in which this prediction is beaten on timing while still being right on substance.
A fifth risk is institutional rather than legal. Comment processing capacity, litigation over other trade actions and the refund workload competing for the same Office of Trade staff all argue for slippage, but a determined political push can reorder priorities quickly. Executive Order 14411 gives this workstream unusually high internal standing, which is the main reason to hold the timing call at high rather than very high confidence.
There is also an honest measurement problem. “The requirements arrive commercially before they arrive legally” is harder to score than a publication date, because broker and marketplace contract terms are not public. The checkpoints below are chosen to be observable.
How to check this call
A forecast that cannot be scored is a slogan. Here is the scoring rubric, with dates.
| Checkpoint | Date | Prediction | Falsifies the call if |
|---|---|---|---|
| Comment period closes on docket USCBP-2026-1058 | December 1, 2026 | Substantial trade-association filings; no draft rule text released | CBP issues rule text alongside the close |
| Unified Agenda entry for RIN 1685-AA47 | Spring 2027 edition | NPRM target date sits in late 2027 or later | Target date lands in H1 2027 and holds |
| NPRM publication | By June 30, 2027 | Not published | Published |
| Binding rule in force from that docket | By November 1, 2027 | Not in force | In force, including via interim final rule on this docket |
| Non-rulemaking implementation actions | By June 30, 2027 | At least two further general notices, test modifications or CTPAT criteria changes tied to Executive Order 14411 | Fewer than two |
On base rates alone, the first four look comfortable. The fifth is the genuinely uncertain one, and it is also the one that matters most operationally, because it is the channel through which costs reach sellers.
Readers who want to file into the docket can do so through the primary notice, which lists the questions in full and the submission instructions: the Federal Register text of the advance notice remains the authoritative reference.
Frequently asked questions
What exactly did CBP propose on September 2, 2026?
It proposed nothing binding. It published an advance notice asking 64 questions across three areas: whether importers should provide the export documentation their suppliers filed with foreign customs authorities, how the parties behind a shipment should be identified, and how supply chain tracing technology and CTPAT criteria should evolve. Comments close December 1, 2026.
Is an advance notice always slow?
Not always, but usually. It is the stage before a proposed rule, which is itself the stage before a final rule, and each transition typically takes a year or more at agencies with heavy dockets. The counter-examples in customs tend to involve executive orders or interim final rules that skip the queue rather than advance notices that move quickly.
Why predict the rule is slow when enforcement is clearly accelerating?
Because they are separate machines. Enforcement runs on existing statutory authority, general notices and penalty policy, none of which requires notice and comment. Rulemaking creates new obligations and carries procedural and litigation risk, so it moves at a different speed. The observation here is that the two have decoupled, not that enforcement is easing.
What is the single most likely way this prediction fails?
An interim final rule issued under national-security framing for a designated product category, following the template used for mail shipments in June 2026. That would produce a binding obligation without an intervening proposed rule, and it is the scenario the advance notice’s grave-risk questions appear to prepare the ground for.
Should a small importer spend money on this now?
The proportionate answer is to spend on what is already live rather than on what is proposed. Form 5106 accuracy and importer of record hygiene carry an immediate consequence. Building a supplier document-collection process for export declarations is a reasonable next step because it is useful under either timeline, whereas buying traceability technology for a rule that does not exist is premature.
Does this affect sellers who ship through a marketplace rather than importing directly?
Increasingly, yes. Question Q33 asks whether the marketplace that facilitated a sale should be identified to CBP, and the European Union has already legislated in that direction. Sellers should expect platforms to pass data requirements down to them contractually well before any US rule assigns platforms a formal role.
Could the requirements be dropped entirely?
Wholesale abandonment looks unlikely while the executive order stands, since the order directs the disclosures rather than merely inviting them. A narrowing is more plausible than a withdrawal: the foreign export documentation piece is the most legally and diplomatically awkward element, and it is the most likely to be scaled back to a recordkeeping obligation or a randomized sampling requirement.
What would make this prediction look obvious in hindsight?
If, by mid-2027, importers are answering broker questionnaires about factory identity and export declarations while the docket has produced no proposed rule, the decoupling described here will read as the plain fact it already is. The reason it is not obvious now is that coverage of trade policy tracks documents rather than instruments, and an advance notice generates more headlines than a general notice does.
How does this compare with the EU’s approach?
The EU has moved earlier and more structurally, placing responsibility on platforms through its customs reform package. The US path so far is more enforcement-led and more incremental, relying on identity verification, penalties and voluntary programs. Convergence on the underlying data set looks likely; convergence on the legal instrument does not.