CBP's September 2, 2026 notice does not impose a completed supply-chain disclosure system. It asks how one might work: which foreign export records should travel with an import, which parties and products should receive stable identifiers, when data should reach CBP, how conflicting records should be reconciled, and whether traceability technology should change CTPAT requirements or benefits.
The controlling source is an advance notice of proposed rulemaking, or ANPRM, with comments due December 1. Its 64 questions may inform a later proposed rule. They are not 64 requirements, and the notice supplies no effective date, final field list, universal technology mandate, or completed cost model.
The question this map answers
What information architecture is CBP considering for imported-goods supply chains, which current records would it build on, and which decisions remain open before any enforceable rule exists?
MyMap reviewed Federal Register document 2026-17926, Executive Order 14411, and the official CTPAT program page at 4:07 AM Pacific Time on September 2. The notice was published that day under docket USCBP-2026-1058. It identifies current authorities, groups proposals into three substantive sections, adds an economic-impact section, and ends with question 64.
In this map, current record means information already associated with entry, manifest, recordkeeping, audit, or voluntary CTPAT participation as described by CBP. Candidate disclosure means a subject on which CBP requests comment. Identity edge connects a role to an identifier. Evidence edge connects a claim about origin, value, quantity, classification, or production to a source record. Decision gate is a choice the agency has not resolved in the ANPRM.
The current base is distributed across different actors and times
The notice begins with a system that already has distinct responsibilities. An importer of record files entry information and uses reasonable care. A carrier supplies manifest information about transported cargo. Parties covered by customs recordkeeping rules retain records that CBP can examine or summon for entry correctness, duties, fees, taxes, penalties, and compliance. CTPAT is a voluntary security partnership with criteria, validation, and benefits for eligible supply-chain participants.
Those records do not arrive as one complete product genealogy. CBP says the longstanding manufacturer or shipper identification code, or MID, is derived from name, address, and country information. It may not identify the party most useful for enforcement, may arrive too late, is not always stable or unique, and can produce the same code for multiple entities.
The map therefore starts with four current nodes rather than a fictional master database. The proposal branches ask how to connect them and what new evidence should cross those boundaries.
Foreign export documents create a reconciliation problem, not just an upload box
Questions 1–23 address documents supplied to a foreign customs or export authority: export declarations, licenses or permits, certifications, commercial invoices, certificates of origin, and related records. CBP asks whether these should be transmitted with entry or entry summary, retained for later production, requested randomly, or targeted by risk.
The actor is also unsettled. The notice asks whether the importer of record should obtain and submit the foreign record or whether another party is better placed to do so. It asks about lead time, translation, retention, authenticity, reasonable care, confidential material, and exemptions.
Most importantly, a foreign export value, quantity, or classification may differ from the value relevant to U.S. entry for legitimate conceptual reasons. CBP asks what internal controls should identify those differences, what evidence should explain them, and whether it should authenticate data with foreign authorities. A reliable map must preserve three separate states: foreign-source record, U.S. entry assertion, and reconciled or unresolved difference. Treating every mismatch as fraud would invent a conclusion the notice does not make.
The national-security questions explore whether designated product or country categories should face across-the-board or randomized document submission. No such category list is established by this ANPRM.
Party identity can be entity-level, role-specific, or product-level
Questions 24–45 ask whether CBP should retain, redefine, supplement, or replace the MID. Candidate roles include manufacturer or producer, shipper, exporter, seller, distributor, packager, an online marketplace, an ultimate delivery party, and logistics platforms used along the route.
These labels are not interchangeable. The manufacturer makes or supplies a finished good; the shipper arranges carriage; the seller is the last known sale party under the test definition. One company may fill several roles, while one shipment may involve several companies. A single arrow labeled “supplier” would hide the relationship CBP is trying to make reviewable.
The ongoing Global Business Identifier test permits four private-sector identifiers: D-U-N-S, Global Location Number, Legal Entity Identifier, and Altana ID. The notice asks whether identifiers should appear at entry, entry summary, or both; whether other foreign tax or business IDs should be used; whether a product-level identifier could convey production detail; and how CBP should respond when identifiers conflict with information submitted by another party.
The map treats those as alternative keys and validation paths. The ANPRM does not choose one national identifier, require all four, or say that an identifier proves the accuracy of the attached supply-chain claim.
Traceability technology is a proposed evidence carrier, not evidence by itself
Questions 46–55 seek information about technologies used to map production, verify raw-material origin, assign identifiers or tamper-resistant credentials, protect proprietary information, and integrate with the Automated Commercial Environment and partner-agency exchanges. CBP asks about AI, interoperability, scale, cost, certification, and protocol vulnerabilities.
Technology can preserve who asserted what and when. It cannot independently establish that an upstream assertion was true. MyMap therefore derives a verification layer between a traceability system and an enforcement conclusion: source authentication, role resolution, product linkage, cross-record comparison, discrepancy explanation, and agency review.
The notice does not prescribe blockchain, an AI model, a vendor, a data standard, or a universal product passport. “What technology is available?” is a request for evidence, not a selection.
CTPAT adds a participation-and-benefit branch
Questions 56–61 ask whether CTPAT partners should use enhanced traceability, expose systems to CBP, receive additional benefits, or meet expanded cybersecurity and data-integrity criteria. One question explores costs if criteria restricted covered logistics platforms considered security risks.
Current CTPAT participation remains the baseline described in the source. The ANPRM does not convert every contemplated technology into a current minimum-security criterion. It asks which tiers, criteria, benefits, transition costs, and supply-chain effects would make such a change workable.
Questions 62–64 then ask respondents for reproducible cost and benefit estimates, including qualitative burdens. That economic record feeds a future design decision; it is not a completed agency estimate of what every importer will pay.
Confirmed, derived, and still unknown
CBP confirms the September 2 ANPRM, December 1 comment deadline, 64 questions, current entry/manifest/recordkeeping/CTPAT base, MID limitations it identifies, four identifiers permitted in the GBI test, and the proposal areas described above. Executive Order 14411 confirms the direction to pursue heightened disclosures; it does not supply the missing implementation schema.
MyMap derives the five-layer architecture: current records, source documents, typed party identities, traceability evidence, and agency validation. It also derives the rule-design gates—actor, field, timing, scope, authentication, reconciliation, burden, and benefit—from questions that recur across the notice. Those labels are analytical joins, not proposed regulatory text.
The sources leave unknown which disclosures will be proposed; who will file them; whether they will be transmitted or retained; which goods, countries, entry types, modes, or business sizes will be covered; whether a test or phase-in will precede a mandate; which identifiers or standards will survive; how confidentiality and foreign-language records will be handled; what discrepancies trigger action; what CTPAT criteria or benefits may change; total costs; an NPRM publication date; final text; and any effective date.
Reproducible mapping method and next step
Create one row for every numbered question with these columns: question number, candidate data object, originating actor, responsible filer, submission time, source record, validation method, discrepancy state, proposed scope, burden evidence, benefit evidence, and rulemaking status. Keep blank cells blank. Group questions only after preserving their numbers so another reviewer can reproduce the map from the notice.
For an operational gap analysis, place current systems and contracts in a separate lane. Mark which party identities, foreign records, product links, timestamps, and reconciliation controls are available today, but do not label missing candidate data as noncompliance. For a public comment, cite the question number and provide reasons, current-practice evidence, and enough information for CBP to reproduce any numerical estimate.
The practical next step is to map what your organization can prove today and submit evidence on the unresolved design gates by December 1. Continue following current customs requirements. Monitor the docket for an NPRM that actually specifies proposed regulatory text; this ANPRM is an architecture inquiry, not the finished system.