CBP has stopped asking questions. Six quarters of enforcement data show it.

New data from CBP puts hard numbers on what customs brokers and importers have been feeling on the ground: Form 29 Notices of Action increased 148% from Q1 2025 to Q2 2026, rising from 4,322 to 10,718. This newly uncovered dataset covers every CBP Form 28 (Request for Information) and Form 29 (Notice of Action) issued during that period. The majority of the growth comes from Notices of Action rather than information requests because tariff-era errors are visible in the entry data itself, letting CBP act on a filing without ever asking the importer about it.

First, the forms

A CF-28 is CBP asking a question: the importer gets roughly 30 days to explain a suspected issue in the entry, and no determination has been made at this point. As opposed to a CF-29, where CBP is making a clear determination of an importer’s error—whether a rate advance, a value advance, a reclassification, or an origin change—and it arrives either as a proposed action with about 20 days to dispute it, or as a final action with no conversation first.

What six quarters of data show

1. Enforcement actions are up 21.2% in one year. CBP issued 31,967 CF-28s and CF-29s in the first half of 2026, up from 26,365 in the first half of 2025. Even the slowest quarter since sits 26% above the Q1 2025 starting point. Volume moved up and stayed up.

2. CBP now makes decisions without asking for information. Q1 2025 was the last quarter where information requests outnumbered enforcement actions. CF-29s have held the majority in every quarter since, peaking at 64.3% of volume in Q3 2025. A growing share of importers now get the bill as their first notice.

3. Nearly all the growth is action, not inquiry. CF-29s in the most recent quarter ran 148% above the series' opening quarter in Q1 2025. CF-28 volume has stayed inside a narrow band all six quarters, which reads as a capacity ceiling: import specialists can only review so many document responses. Enforcement growth flowed to the channel that scales, action taken directly off entry data.

4. Entry accuracy at time of filing is now the whole game. The inflection point is Q2 2025, exactly when the 2025 tariff expansions took effect. Section 232 derivative coverage, Chapter 99 stacking, and origin-dependent duty rates create errors CBP can detect from the entry data alone, no documents required.

This is what the technology gap looks like

In a recent webinar on 19 CFR & AI, Cindy Allen estimated the private sector is five to seven years behind CBP's current AI capabilities, built on top of ACE, the largest repository of U.S. trade data. This enforcement data is proof that the five to seven year tech gap is real. CF-29 volume swings with tariff events because AI-assisted targeting scales instantly. The evidence for this is now clear: CF-28 volume stays flat. In the new “enforcement-led” era, CBP already knows what it’s looking for.

It also confirms something our CEO Hugo said on that webinar: compliance only moves in one direction, its rare that compliance requirements are peeled back. The expansion of tariffs in 2025 to reflect the policy priorities of the Administration handed CBP thousands of new rules during a time that they can actually be enforced and checked by machines, and the CF-29 numbers show this very clearly.

What to do now

In practice, three habits matter most:

• Get back to the fundamentals on every entry. What is the product, where does it come from, and what is it made of, including whether you can see past your first-tier supplier. This shift in focus matters now more than ever.
• Decide your audit-readiness approach before the notice arrives. As Cindy Allen made clear in a recent webinar on 19 CFR & AI, this enforcement environment has been building for a decade and it is not temporary. The organizations that adapt early are the ones best positioned when the next wave hits. With enforcement actions growing 21.2% a year, waiting only raises the cost of the same decision.
• Be able to demonstrate your process and not just your outcomes. Responsible supervision and control means documented processes, reviewed outputs, and decisions that you are ready to explain when CBP asks. When the first contact is a CF-29 with a 20-day clock, that documentation is the difference between assembling a rebuttal and already having one.

Your ability to demonstrate compliance is the most important item you could close off your checklist before the end of 2026.

Get the full report

The complete analysis covers all six quarters: quarterly volumes, mix shifts, growth rates, and the operational read on why the ratio flipped. →Download the full Quarterly Enforcement Report