Importing Is a Privilege Now, and CBP Has the Technology to Enforce It

Importing into the US is changing as CBP places more focus on who is importing, where goods come from, and how much information companies can provide about their supply chains. At the 2026 CBP Trade and Cargo Security Summit in Dallas, one message stood out: importing is increasingly being treated as a privilege that comes with greater responsibility.

On Episode 8 of the Trade and Tech podcast, Mark Tallo joined Emil Stefanutti and Tom Gould to discuss what this means in practice. Their conversation covered how CBP is using AI and technology to review information at scale, while also looking more closely at importer records, supply chain visibility, broker due diligence, and the systems companies use to manage compliance.

"You Get to Import Goods": The New Answer to the ROI Question

Asked to reduce three days of sessions to one message, Tallo picked the framing CBP repeated in different forms throughout. "Importing is a privilege and not a right," he said. "If you want to be an importer, there are certain things that CBP expects you to do. Having a tax ID number and a broker isn't enough anymore."

The sharpest illustration came from a breakout session on the final day. Someone from an importing company stood up and asked CBP how to sell all this increased compliance internally. What does my company get out of it, he asked. What is the ROI? Tallo relayed the answer: "You get to import goods."

That marks a shift from the model the trade has operated under for two decades. Customs historically incentivized trusted traders by "putting carrots right out," as Tallo put it, promising expedited clearance or fewer requests for information in exchange for visibility. The new posture treats that visibility as the baseline and entry itself as the reward.

Gould was blunt about how much work hides inside the slogan. "It's a simple thing to say, but it really is a complex concept," he said. "We've all understood for many, many years that importing is a right. Anybody can do it. Now when they take the attitude of importing as a privilege, things become more complicated, more difficult. You have to prove that you're eligible."

The Importer of Record List Is Being Rebuilt, and Clean Is Not the Same as Correct

Stefanutti raised figures circulating in attendee recaps from the summit: CBP discussing roughly 10,000 importer of record verification notices, 88% of recipients failing to verify, around 9,000 IOR numbers voided, and 800 cases involving confirmed use of stolen identity information. He flagged the caveat himself, and it is worth repeating. These are not numbers CBP has published in a formal statistical release. They are figures discussed at the summit and reported second-hand.

Tallo read them as a cleanup rather than a fraud sweep. "The importer of record identity database has not been tended to in a long time," he said. By his recollection there are over 300,000 unique importers of record on file, and perhaps a third import regularly in any given year. Most non-responses, on that reading, are companies that no longer exist or no longer import. Fraud is real and he has seen IOR numbers used for entries that were not theirs, but he expects it to be a small share.

Where 5106 Records Become Important

Gould focused on a different concern, one that can also affect compliant companies. The form at issue is the 5106, which puts an importer's identity into ACE. As records get cleaned up, CBP is finding errors in the data: old addresses, missing phone numbers, company names that do not match what is on file with a Secretary of State or the IRS.

"I'm concerned that customs is going to be looking at some of these nitpicky little errors," Gould said. "We see ABC Inc. in our 5106 data, but there's no ABC Inc. out there. There's an ABC LLC. And so we're going to deactivate ABC Inc.'s number and let them fix it. And by the way, they're not going to be able to import until they correct it."

Tallo agreed and turned it into the most immediately actionable item in the episode. "Customs is coming, they will be looking. They're scrutinizing the importers of record. So now is the time to dust it off and validate. Has our entity name changed? Maybe it changed a decade ago, but it never got updated in customs' system."

The Asymmetry: CBP Automated Its Side of the Exchange First

Gould framed the convergence: more tariffs, more enforcement, and more capable tools arriving at once. What CBP wants declared has expanded well past what is in the box.

"Gone are the days when you would bring a product in and you would tell customs this is the product I'm bringing in and this is what I paid for it and this is where it came from," Gould said. "Now we need to tell customs about everything that went into making the product, all the way back to the raw material." His examples were the cotton in a t-shirt and the polysilicon mined for a solar cell. With current tools, CBP is far better able to ingest that volume and target accordingly.

Tallo's asymmetry point is the consequence. Importers assemble evidence manually, then hand over thousands of pages that CBP processes with AI because it lacks the staff to read them. "The next phase is how do importers leverage AI tools and other technology to build that type of transparency and information into their supply chain?," he said. "The pace and speed of that has to increase to keep up with this heightened enforcement."

CAPE Shows What Processing at Scale Looks Like

Gould gave the clearest worked example of CBP's side already operating at scale: the IEEPA refund process running through CAPE. Before CAPE, he said, refunds were reviewed one at a time by a person. Now the data gets scrubbed before refunds are issued, and errors are corrected across an entire population rather than one entry at a time.

"I've seen situations where a company imported products from China, they paid the IEEPA tariff, but they didn't pay the old Section 301 tariff that was applicable," Gould said. "Instead of finding that on one entry or an entry here and there, customs found it on every single entry where the error was made." He noted that Gaia does the same thing from the importer's side, finding those errors in bulk so companies can correct them before customs does.

Tallo added the underused half of the story. Mass processing cuts both ways, and the same automation that speeds targeting can speed refunds through CAPE and ordinary protest work, where one change can require fixing a thousand entries. He sees opportunity in the trade and CBP agreeing formats that let corrections flow without manual rekeying.

On whether CBP will hold itself to the human-in-the-loop standard it asks of importers, Tallo expects validation to stay human even where targeting does not. AI will "facilitate its work, but certainly not supplant the decision making of an import specialist, at least in the next five years."

How Far Upstream Is "Dirt to Shirt"?

Shortly before the summit, CBP published an advance notice of proposed rulemaking on heightened import disclosures and supply chain visibility, built around 64 questions. Its status matters because the rules are still being shaped rather than already in force.

What the Advance Notice Means for Importers

CBP could have issued an interim final rule, Tallo said, which "basically means here's the rule, it's going into effect now or almost immediately, and give us comments about it at some point in the future." That "would have been really difficult for the trade to digest."

Instead, the advance notice functions more like a request for information. Tallo credited CBP for taking that route, noting that the agency acknowledged at the summit that its people understand government and operational policy but do not always see how businesses function day to day.

CBP wants to understand the differences between a large multinational retailer and a small wholesaler, and between industries such as apparel and electronics. Tallo said "it would be disappointing for us all in the trade not to take customs up on it," because the responses will help shape "policy and rules that may shape the next decade or two of imports."

How Deep the Supply Chain Review Needs to Go

Gould described an agency expectation he has encountered for years. "Many people at customs really don't understand the supply chain or the businesses," he said. "Their attitude was, well, you make a t-shirt, why don't you know where the cotton was from? You must know that, because you made the t-shirt." The same logic can extend from a finished car back to the source of the steel used in its components.

Tallo's approach is to determine the required depth from the enforcement issue involved:

CBP may want "dirt to shirt," Tallo acknowledged, but the level of visibility needed in practice depends on the enforcement regime involved.

The Response Window Is Getting Tighter

The other constraint is timing. Gould said requests for information previously came with 30 days and routine extensions. "On day 29, you'd go to customs and say I need more time, and they would give you more time, and you would do that over and over again, and you could stretch it out to two, three, four months. It's no longer the case."

CBP now expects much of that information to be readily available, making advance collection of origin and production records more important than relying on extensions after a request arrives.

Brokers Are Being Asked to Become a Frontline, and the Trade Is Split

CBP has said brokers must conduct greater due diligence on clients. Tallo described customs moving away from viewing brokers as "a passive relay of information" toward something closer to a frontline defense, and relayed the pushback he heard in Dallas: brokers saying they are not experts in "reviewing passports or driver's licenses and figuring out whether or not they are legitimate."

Gould sees two camps. "Some customs brokers are saying, customs, this should be your responsibility. And others are saying, this may be an opportunity for us to step up and show that we are more of a partner." He leans to the second. 

Traditionally a broker signing a new client "would get a power of attorney, an email with a PDF copy, put it in their file and they were done," and he does not think that survives scrutiny in an industry where opening a bank account requires more.

His competitive point gets less attention than it deserves. Brokers who asked for identification historically lost business to those who did not, because "the pushback was, the other broker never asked me for that." With CBP vocal about vetting, that race to the bottom gets harder to run. He does not expect the standard to vary with broker size, only the process: large firms formalizing it through systems, small firms through direct relationships.

The Documents CBP Wants Do Not Always Say What It Hopes

The ANPRM also asks whether importers should obtain or submit the documents their suppliers file with foreign customs authorities, on the logic that export and import records can be compared for mismatches in value, quantity or description. Both guests think that comparison is weaker than it sounds.

Tallo's example: an exporter sells to a trading company in a third country at a dollar a unit, and that trading company sells to the US importer for a dollar twenty. "When you compare a dollar to a dollar twenty, I don't know how relevant that is." Classification fares no better, since harmonization runs only to six digits.

Gould added two structural obstacles. Of the eleven Incoterms, he said, only one gives the importer access to export data at all, because under the others clearing export is the supplier's job. And by his account US rules restrict American companies from providing export information to foreign parties, a hurdle CBP would have to clear before requiring the mirror image of it.

The plumbing underneath is the quieter constraint. ACE "is not a program like Microsoft Word. ACE is a whole platform," Gould stressed, and its weakness is moving data in and out: the pipeline brokers file through "goes back to the days of punch cards," while importers still pull reports as spreadsheets. He is hopeful about APIs, which would let importers analyze their own data properly and let CBP receive structured data rather than scraping PDFs.

Dust Off the 5106 Before the Rules Land

Asked what will be materially different a year from now, Tallo started with "what won't be," then gave a real answer: clearer rules of the road, and an expectation that goes well past the contents of the shipment. "Not just telling customs what's in the box, but where did it come from? Who made it? Who shipped it? Who is entering those numbers? Do you have a sufficient nexus to the US to be an importer of record?"

None of that is comfortable, but almost all of it is work that can start before any rule is final. Validate the 5106 record against corporate filings. Decide, per product, which enforcement regime governs and how far back it requires you to see. Ask suppliers for origin evidence assuming 30 days and no extension. Read the 64 questions and answer the ones that describe your business. And on the one asymmetry squarely within an importer's control, the gap between CBP reviewing populations of entries and companies reviewing them one at a time, the remedy is running the same analysis on your own data first. Tallo's line on supplier certifications is the summary: "I dare to say we are past the point where a supplier's certification is sufficient."

Explore Gaia Dynamics to see how the platform helps importers review customs data at scale, improve visibility across entries, and prepare for more data-driven CBP oversight.

Want to hear the full conversation?

Listen to Episode 8 of the Trade and Tech podcast for the full discussion, including what a senior CBP technology official revealed about the volume of attacks the ACE platform absorbs every day.

FAQs

Are the importer of record verification figures official CBP statistics?

No. The figures discussed in the episode, including roughly 10,000 verification notices, an 88% failure-to-verify rate, around 9,000 voided IOR numbers and 800 stolen-identity cases, came from summit discussions and attendee recaps rather than a formal CBP statistical release. Stefanutti noted this caveat when raising them.

Does an advance notice of proposed rulemaking change anything today?

No. An advance notice is a request for information that comes before regulations are drafted, so nothing in the 64 questions is currently binding. CBP has not written the regulations yet, which is why Tallo and Gould encouraged companies to respond while the rules are still being shaped.

How far back in the supply chain does an importer actually need to see?

It depends on the enforcement regime involved. For transshipment and origin questions, Tallo said importers should trace back to the origin-conferring operation and support it with production records. For forced labor, the review may need to extend through the full supply chain to establish the source of relevant materials.

Will CBP still grant extensions on requests for information?

Not reliably. Gould said the previous practice of extending a 30-day response period over several months is no longer the norm. CBP now expects importers to have much of the required information readily available, making it more important to gather origin and production records in advance.

Does using a customs broker satisfy the new due-diligence expectations?

No. CBP expects brokers to conduct greater due diligence on the importers they file for, while importers remain responsible for what is declared. Gould expects the same standard to apply regardless of broker size, although larger firms may use formal systems while smaller brokers rely more on direct client relationships.