EU customs code brings AI into risk analysis

The EU published its new Union Customs Code, Regulation (EU) 2026/2108, in the Official Journal on 19 September. It entered into force the next day and most of it applies from 21 September 2027. Its definition of risk analysis, the work customs do to decide which goods to check, covers the processing of data to identify or quantify possible risks "using where relevant analytical methods and artificial intelligence (AI) systems". The definition refers to the EU Artificial Intelligence Act, which describes an AI system as a machine-based system that infers from the data it receives how to produce outputs such as predictions, recommendations or decisions.

In its recitals the regulation says that technology, in particular AI, will have a significant impact on customs work, including real-time risk analysis. For a company that imports food into the EU, the question is what the software will do with its data, and who decides what happens to a consignment.

Software raises the signal and customs take the measures

In the regulation's terms, a risk signal is the indication of a possible risk, produced by automated processing of data, information or documents. A risk analysis result is the finding that a risk is or is not present, reached "based on an automatic process or on further human assessment of the risk signal". Risk mitigation measures are what customs then do, such as telling a carrier not to load goods or asking for more documents.

Under Article 55, the Commission, the new EU Customs Authority and national customs authorities decide, "primarily on automated risk analysis", whether goods, companies or supply chains will face such measures, and where and when. The EU Customs Authority runs risk management at EU level and sends signals and control recommendations, while national customs carry out their own analysis and take the measures. Because the result can be reached automatically, the customs code does not require a person to review every signal. Any AI system used has to comply with the AI Act, as Article 38 states.

A single EU data hub will hold the data the analysis reads

The regulation creates the EU Customs Data Hub, a central EU system for the data that companies provide to customs. One of its functions, under Article 38, is to enable risk analysis, economic analysis and data analysis "including through the use of artificial intelligence systems" in line with the AI Act. The recitals add that the hub should draw on existing EU sources of risk information, naming the rapid alert system for food and feed alongside the alert system for non-food products, and should support predictive analysis of consignments entering or leaving the EU.

The rules on distance sales and most of the rules on the EU Customs Authority apply from 1 July 2028. Other companies can start using the hub voluntarily from 1 March 2031, and by 1 March 2034 all economic operators are to use it.

The importer answers for the data and for compliance with food rules

Under Article 27 there is only one importer of a consignment at a time. The importer has to provide or make available all the information customs require before the goods are released, ensure that duties are paid, and ensure that the goods comply with the other EU rules that customs enforce at the border, keeping records of that compliance. The regulation places these duties on the importer and makes no exception for data that software has prepared.

Article 55 also says that customs take into account any notified case of an importer failing to comply with those other rules, and that it counts towards the importer's risk profile. A notified breach of food or plant health rules therefore becomes part of the importer's record that the analysis reads.

Tunisia supplied most of the olive oil the EU imported from outside the bloc in 2025

In 2025 the EU imported 189,209 tonnes of olive oil from outside the EU, worth €724 million, according to Eurostat. Tunisia supplied 155,637 tonnes, or 82% of that quantity, up from 63% in 2024. Buyers in Italy, Spain and the United States have also been turning to Tunisian oil to make up for short Greek supply. Imports from Turkey fell from 31,164 tonnes in 2024 to 5,535 tonnes in 2025, from 16% to about 3% of the total.

Bar chart of EU olive oil imports from outside the EU by origin, Tunisia, Turkey and other origins, in thousand tonnes, 2023 to 2025

EU imports of olive oil (CN 1509) from outside the EU by origin, thousand tonnes, 2023 to 2025. Source: Eurostat, EU trade since 1988 by HS2-4-6 and CN8 (DS-045409).

The regulation does not say which risk criteria will apply to olive oil or to any other product. Common risk criteria and priority control areas are set by the Commission, which the EU Customs Authority can assist with input and expertise under Article 57.

Four points an importer can check before September 2027

Data: who in the company supplies the customs data, and whether it is complete before release. The same applies where AI agents that book freight or other software fill in shipment details.
Compliance records: food safety, plant health and authenticity records kept where they can be shown to customs, since notified non-compliance counts towards the importer's risk profile. Olive oil is a known target of food fraud.
Signals: who in the company, or at its customs representative, responds when a consignment is flagged, since the result of a signal can be reached automatically or by a customs officer.
Dates: 21 September 2027 for most of the code, 1 July 2028 for distance sales and the EU Customs Authority's tasks, 1 March 2031 for voluntary use of the data hub and 1 March 2034 for everyone.