The numbers define the scale of what is happening. In FY2024, CBP collected $117.7 million from importer audits across the full year. FY2025 collections reached $235.46 million. FY2026 enforcement has accelerated further, with CBP collecting $182.22 million from just 181 audits through 30 April 2026, so the average recovery per audit has crossed the one million dollar mark. That is not a gradual trend. It is a step change in enforcement intensity, and the tool driving it is artificial intelligence.
For companies importing servers and networking equipment, diagnostic equipment, aerospace components or heavy equipment, the question is not whether CBP’s systems are looking at their entries. It is whether those entries will pass review when they are selected. This guide explains how the CBP customs audit 2026 environment works, what the targeting system looks for, which gaps trigger the most enforcement action, and what to do before a CF-28 arrives.
Key takeaways
- CBP audit recoveries roughly doubled between FY2024 and FY2025, and FY2026 is averaging over $1 million per audit.
- Classification, valuation, origin and UFLPA forced labour are the four gaps behind most referrals.
- A CF-28 is an information request, not a penalty. The quality of your response decides whether it escalates.
- A prior disclosure filed before CBP contacts you limits a negligent or grossly negligent underpayment to the duty plus interest.
Why the CBP Customs Audit 2026 Environment Is Different
Three forces are converging in 2026 to create one of the most aggressive customs enforcement environments in modern US trade history.
Force 1: Revenue Incentive at an Unprecedented Scale
The Federal Reserve Bank of Richmond reports that the US collected around $287 billion in customs duties, taxes and fees in calendar year 2025, up about 192% on 2024. That increase is driven by the layered tariff environment, including Section 301 duties on Chinese-origin goods, Section 232 duties on metals and derivatives, and the IEEPA tariffs collected until the Supreme Court struck them down on 20 February 2026. CBP has both the incentive and the mandate to collect every dollar owed. Importers who underpay, misclassify or claim preferences they do not qualify for are the highest-value targets in the agency’s history.
Force 2: AI-Powered Targeting Is Operational
CBP publishes its audit collections in its trade statistics. Its Automated Targeting System (ATS) cross-references entry data against commercial databases, supplier information and historical entry patterns, and CBP has been expanding its use of AI and data analytics to map supply chains and detect transshipment through third countries. Data that once needed a manual audit is now screened at the time of filing. The system looks for five anomaly types.
- Classification inconsistencies: the same product classified differently across entries, or in a way that does not match the product description or supplier invoices.
- Valuation anomalies: values well below market rates, sudden drops for the same product, or patterns consistent with invoice splitting.
- Origin patterns: routes consistent with transshipment, sudden origin shifts from the same supplier, or origins that do not match the supplier’s known manufacturing footprint.
- Preference claim mismatches: FTA claims that supply chain data does not support, or duplicate tariff exclusion claims.
- Shell company signals: new or thin entities claiming large import volumes inconsistent with their profile.
The system does not need to identify fraud. It flags statistical anomalies, and a CBP officer then decides whether to issue a CF-28 Request for Information, a CF-29 Notice of Action, or refer the case for a Focused Assessment or formal investigation.
Force 3: The DOJ-DHS Trade Fraud Task Force Is Producing Results
On 29 August 2025, the Department of Justice and the Department of Homeland Security launched a joint Trade Fraud Task Force to pursue customs fraud through criminal prosecution, civil penalties and False Claims Act litigation. It moved fast. In December 2025, Ceratizit USA agreed to pay $54.4 million to resolve allegations of misclassification, failure to mark country of origin and transshipment dating back to 2015. In a separate case, a former chief operating officer of MGI International was criminally charged and agreed to plead guilty to a smuggling conspiracy. Enforcement now reaches back years and holds individuals personally accountable.
The mechanism most importers overlook is the False Claims Act qui tam provision. Former employees, competitors or anyone with knowledge of duty evasion can file suit on the government’s behalf and receive a share of the recovery. The Ceratizit case began with a whistleblower complaint, and the relator’s share was about $9.75 million. The DOJ Corporate Whistleblower Awards Pilot Program, launched in August 2024, added customs and trade fraud in May 2025. CBP’s e-Allegations portal also lets anyone report suspected trade fraud anonymously, and those reports can lead to a CF-28 or audit referral.
The Four Compliance Gaps That Trigger the Most CBP Audit Referrals
Trigger 1: HS Code Misclassification
Classification is the highest-volume audit trigger in 2026. With layered tariffs applying at different rates to different HS codes, the financial incentive to misclassify is higher than ever, and CBP’s systems flag classifications that do not fit the product description, the supplier’s range or past practice. For IT hardware importers, the specific risks are these.
- Chapter 84 vs Chapter 85: computers and servers (Chapter 84) and networking and electrical equipment (Chapter 85) can carry different Section 301 exposure. Misclassification between them, deliberate or a broker error, generates an anomaly.
- ITA product eligibility: not every IT product qualifies for the Information Technology Agreement zero duty rate. Claiming it for goods outside the definition creates an underpayment CBP can spot by comparing declared and expected duty.
- AI hardware: GPU accelerators, inference cards and high-performance computing components fall under various Chapter 84 and 85 subheadings with different Section 301 exposure, and their rapid growth has put them under particular scrutiny.
Trigger 2: Customs Valuation Discrepancies
Valuation is the second highest-volume trigger. CBP compares declared values against market data, comparable imports and the importer’s own history. Values well below market, sudden drops for the same product, split invoices, and royalty or licence fees paid outside the invoice that may belong in the customs value all prompt review.
For medical device importers, related-party transfer pricing is the pressure point, because transfer pricing documentation that does not support the declared customs value is a documented audit trigger. For aerospace and industrial equipment importers, long-term contracts with price escalation clauses can let declared values drift from market prices over time, which the system flags.
Trigger 3: Country of Origin and Transshipment
Origin is the priority the Trade Fraud Task Force has pursued most aggressively, and both of its December 2025 enforcement actions involved Chinese-origin merchandise. If you shifted IT hardware sourcing from China to Vietnam, Malaysia, Thailand or Mexico in response to Section 301 tariffs, the documentation behind that shift must be airtight. A company that sourced from China-based suppliers in 2023 and now declares Vietnam as origin for the same products from the same corporate family sits squarely in the risk profile CBP’s targeting is designed to catch.
Trigger 4: UFLPA Forced Labour Enforcement
The Uyghur Forced Labor Prevention Act presumes that goods made wholly or partly in Xinjiang, or by entities on the UFLPA Entity List, were made with forced labour and are barred from entry unless the importer rebuts that presumption with clear and convincing evidence. Solar cells and modules, polysilicon, aluminium, steel and certain electronics have well-documented supply chain links to Xinjiang, and CBP can detain any shipment with a potential nexus. CBP publishes UFLPA enforcement statistics. Here the burden of proof reverses, and the importer must demonstrate compliance.
How a CBP Audit Escalates: CF-28 to Focused Assessment
Knowing the sequence helps you respond correctly at each stage and avoid turning an information request into a formal investigation.
| Stage | What it means | Response window | What decides the outcome |
|---|---|---|---|
| CF-28 Request for Information | CBP asks for invoices, purchase orders, proof of payment, origin documents, classification or valuation support for specific entries. It is not a penalty. | Typically 30 days | A complete response addressing every item often closes the matter. An incomplete or late one escalates it. |
| CF-29 Notice of Action | CBP has found a discrepancy and proposes reclassification, a value adjustment or a duty assessment. | Typically 20 days | Uncontested, it becomes binding and the entry liquidates with extra duty. Contested with strong evidence, it can be resolved in your favour. |
| Focused Assessment | A structured audit of your classification, valuation, origin procedures and internal controls across a defined period, typically one to three years of entries. | Set by the audit team | Can lead to duty assessments, penalties, liquidated damages and referral to the Trade Fraud Task Force. |
The retrospective exposure is significant. The statute of limitations for customs penalties is generally five years, so a compliance gap from 2021 or 2022 can still be within scope in 2026.
Five Actions Every Importer Should Take Now
1. Audit your HS classification for every active product line
Verify every product you import against the current Harmonized Tariff Schedule, and check the upcoming HS 2028 update, which takes effect on 1 January 2028 and may change your codes. Support each classification with a CBP ruling or documented internal analysis, since a binding ruling is the most defensible support available. A code that was correct in 2022 may be wrong in 2026. Pay particular attention to Chapter 84 and 85 products with Section 301 exposure, where the gap between correct and incorrect classification can be 25% or more in tariff liability.
2. Document every sourcing shift made since 2022
If you moved sourcing from China to Vietnam, Malaysia, Thailand, India or Mexico, compile the full origin trail now, including supplier qualification records, manufacturing process documentation, substantial transformation analysis and bills of materials. Our guide to supply chain diversification away from China sets out the documentation framework. The Task Force is targeting origin declarations that changed just as Chinese origin became more expensive, and origin evidence you cannot produce for a CF-28 is the gap that turns an information request into a Focused Assessment.
3. Review valuation for related-party transactions
If you buy from a parent, affiliate or subsidiary, confirm your customs value satisfies CBP’s related-party standards. A transfer price that satisfies your tax authority may not satisfy CBP. The declared value must meet the transaction value standard or one of the alternative methods under 19 USC 1401a. Where a multi-tier supply chain exists, a first sale for export valuation needs the same level of documentation.
4. Set up a prior disclosure process for any gaps you find
If your review uncovers a past classification error or undervaluation, file a prior disclosure before CBP contacts you. For negligent or grossly negligent violations, this limits the outcome to the unpaid duty plus interest. Discovered by CBP instead, the same underpayment can carry penalties of up to two times the lost duty for negligence, four times for gross negligence, and up to the domestic value of the goods for fraud. If you paid IEEPA tariffs, our guide to IEEPA tariff refund claims through the CAPE portal covers the parallel reclaim opportunity.
The Importer of Record named on each entry carries the legal responsibility for its accuracy, which is why the choice of importer of record services matters as much as the paperwork itself.
5. Assign trade compliance ownership and document your controls
A Focused Assessment specifically evaluates whether you have written procedures for classification, valuation and origin, plus periodic internal audits. Importers who can show these are treated differently from those who cannot. A specialist provider can run classification audits, valuation reviews, origin frameworks and CF-28 response support. Carra Globe’s global trade compliance service covers these areas for IT hardware, medical device, aerospace and heavy equipment importers, alongside export control screening for sensitive hardware.
Carra Globe works through importer-side registrations and local importing structures appropriate to the goods and destinations it accepts, its own in some markets and established local structures in others. Approvals falling outside the available structure are flagged before a delivery date is agreed.
Frequently Asked Questions
How does CBP’s AI system select which importers to audit?
It scores entries for statistical anomalies in classification, valuation and origin. Inconsistent classification, values below market comparables, or supply chain patterns consistent with transshipment raise the risk score. Volume alone does not decide selection, so a small importer with a consistent anomaly pattern can be selected as readily as a large one.
How far back can a CBP audit reach?
The statute of limitations for customs penalties is generally five years. A Focused Assessment opened in 2026 can therefore cover entries from 2021 and 2022. The $54.4 million Ceratizit settlement in December 2025 involved conduct dating back to 2015, showing that False Claims Act cases can reach further still.
What is the difference between a CF-28 and a CF-29?
A CF-28 asks for information, and a CF-29 proposes action. With a CF-28, CBP is requesting documents to support entries already filed, and no non-compliance has been determined. With a CF-29, CBP has found a discrepancy and proposes corrective action, which is where duty assessments begin. A strong CF-28 response often prevents a CF-29.
Is IT hardware at higher audit risk in 2026?
Yes. Chapter 84 and 85 products carry significant Section 301 exposure on Chinese-origin goods and have seen widespread sourcing shifts to third countries since 2022, both of which are high-priority risk indicators. AI hardware, including GPU accelerators, faces additional scrutiny for both classification and export control compliance.
What happens if I discover a classification error before CBP contacts me?
File a prior disclosure with CBP straight away. Filed before CBP begins a formal inquiry, it limits a negligent or grossly negligent violation to the unpaid duty plus interest. The same error found during an audit can carry penalties of up to two or four times the lost duty. Prior disclosure is the most effective tool an importer has for a gap that has already occurred.
Concerned about your exposure? Contact Carra Globe or email info@carraglobe.com to review your classification, valuation and origin documentation before a CF-28 arrives.