Legal notice: This article provides an overview of social security, tax, employment and data protection aspects of cross-border remote work under German law (as of February 2026). The information does not replace individual legal advice from specialist lawyers, tax advisers or auditors. Each case requires a specific legal review that takes into account the particular combination of countries, type of activity and company structure.
Working from Spain for two weeks sounds straightforward. The legal consequences are not. Social security, tax, permanent establishment risks and data protection obligations turn an individual wish for flexible working into a company-wide compliance task. If you want to enable remote work from abroad for employees of a German company in 2026, you need clear structures and documented processes.
Workation is not the same as remote work: clear definitions
Remote work describes working permanently outside the company's premises from a fixed place of residence. Mobile working allows flexible changes of location within Germany. A workation combines work with a temporary stay abroad.
Why the distinction matters legally
The choice of term determines which documentation duties apply and which authorities are responsible. Cross-border telework is subject to different thresholds than a classic posting. For employers, this means that policy documents must state precisely which forms of work are permitted under which conditions.
EU Regulation (EC) No 883/2004 distinguishes between posting (on the employer's instruction) and normally pursuing an activity in several states. This distinction has a direct impact on social security obligations and documentation effort.
The 5 critical risk areas of remote work from abroad
Risk 1: social security liability changes at 25 percent of working time abroad
Since July 2023, the multilateral framework agreement on cross-border telework has set thresholds. If working time in the country of residence exceeds 25 percent, German social security liability no longer applies. Between 25 and 49.99 percent, employers can apply for an exception agreement that is valid for a maximum of three years.
Risk 2: tax follows the place-of-work principle
Income from employment is taxed where the work is performed. The 183-day rule only secures the country of residence's right to tax if three conditions are met at the same time:
- Stay of less than 183 days
- Payment by an employer resident in the country of residence
- No costs borne by a permanent establishment in the state of activity
The letter of the Federal Ministry of Finance (Bundesministerium der Finanzen, BMF) of 12 December 2023, amended by the BMF letter of 19 December 2025, clarifies how the rule applies to remote work situations.
Risk 3: a home office does not automatically create a permanent establishment
The OECD 2025 update to the Model Tax Convention introduces quantitative thresholds for the first time. A home office only counts as a fixed place of business if two criteria are met:
Permanence test: use for more than 50 percent of working time over a twelve-month period.
Commercial reason test: physical presence in the state concerned facilitates the business, for example through direct client contact or access to local resources.
Cost savings or employee retention alone do not create a permanent establishment. This Ashurst analysis shows that companies can manage the risk through activity profiles.
Risk 4: documenting working hours remains a German obligation
The mandatory time recording in Germany in 2026 applies regardless of where the work is done. Employers must prove that statutory maximum working hours and rest periods are observed. When employees work abroad, documentation becomes more complicated because of different time zones and local public holidays.
With ZEP, the evidence for recording working hours in the home office stays consistent across borders. Employees book the start of work, breaks and the end of work in ZEP, whether they are working from Berlin or Barcelona.
Risk 5: data protection requires a third-country check
Within the EU and the EEA, the GDPR applies uniformly. For work outside these areas, employers must demonstrate safeguards for an adequate level of protection under Articles 44 to 50 GDPR. The Bund-Verlag special on data protection during workations stresses that accessing data from third countries counts as a transfer and requires appropriate protective measures.
Mandatory VPN, encrypted connections and access logging are minimum standards. For workations in the USA or Southeast Asia, the data protection officer must check which additional safeguards are required.
Social security: A1 certificate electronic-only from 2025
Who needs the A1 certificate
The A1 certificate documents that German social security law applies during cross-border work. Since 1 January 2025, it can only be applied for electronically. Paper applications are no longer accepted.
Electronic procedure via the SV-Meldeportal
Employers use their certified payroll software or the SV-Meldeportal (social security reporting portal). The German Liaison Agency Health Insurance – International (Deutsche Verbindungsstelle Krankenversicherung – Ausland, DVKA) processes applications for people with multiple jobs and exception agreements. Processing normally takes three working days.
Cross-border commuters and the 49.99 percent rule
Cross-border commuters are people who return to their place of residence daily or weekly. If the home office share is below 50 percent, German social security law can continue to apply. The multilateral framework agreement currently applies to 22 states, including all of Germany's neighbouring countries plus Finland, Ireland, Spain, Portugal and other EU states.
The health insurer TK points out that if the 50 percent threshold is exceeded without an exception agreement, the social security law of the country of residence automatically applies.
Tax law: the 183-day rule is more complex than it seems
Three conditions must be met at the same time
Many employers know the 183-day threshold but overlook the additional conditions. The right to tax only remains with the country of residence if all three criteria apply:
- Stay or activity in the other state of less than 183 days
- Remuneration paid by an employer resident in the country of residence
- Costs are not borne by a permanent establishment or fixed base in the state of activity
Splitting salary by actual working days
If the threshold is exceeded or the conditions are not met, salary is split day by day. The BMF letter of 8 October 2024 requires the daily table to be used from 2025. Simplification rules using monthly tables no longer apply.
Check country-specific double taxation agreements
Not all double taxation agreements (Doppelbesteuerungsabkommen, DBA) use the calendar year as the reference period. The UK counts from 6 April to 5 April of the following year. Luxembourg and Norway use rolling twelve-month periods. These differences require country-specific documentation and evidence.
Permanent establishment risk: the OECD 2025 update brings planning certainty
50 percent threshold as a guideline
If an employee works less than 50 percent of their total working time from a home office abroad, this is generally not considered a fixed place of business. Exceptions are possible in special circumstances.
Commercial reason test as the deciding criterion
The commercial justification is decisive. A sales employee with weekly client meetings on site is more likely to create a permanent establishment than a software developer who delivers exclusively remotely. Physical access to local markets, suppliers or customers is the central criterion.
Activity profiles as a risk filter
Companies should classify activities by permanent establishment risk:
- Low risk: pure delivery work without local interaction, development work, internal project work.
- Medium risk: customer service with occasional on-site appointments, project management with hybrid working.
- High risk: sales roles with authority to conclude contracts, managing director activities, strategic decision-making roles.
The classification determines which countries and lengths of stay can be approved.
Employment law: which law applies when working abroad
Place of work versus contract law
As a rule, German employment law continues to apply to short-term work abroad if Germany is the habitual place of work. For longer stays, local protective provisions may apply. A case-by-case review under employment law is recommended.
Time recording as the compliance foundation
Working time recording documents not only working hours but also compliance with rest breaks and maximum working hours. This evidence is decisive in employment law disputes.
In ZEP, employees book the start of work, breaks and the end of work. Booking works without GPS and regardless of location and meets the legal requirements for 2026.
Accident insurance cover abroad
Statutory accident insurance cover generally also applies during temporary work abroad. The duty to notify the responsible employers' liability insurance association (Berufsgenossenschaft) and the documentation requirements remain in place. For longer stays, additional cover should be considered.
Data protection: EU versus third countries
GDPR applies uniformly in the EEA
The same data protection standards apply within the EU, the EEA and Switzerland. Employers must nevertheless ensure that technical and organisational measures are observed. Public Wi-Fi, shared workspaces and unsecured connections remain risk factors.
Third countries require additional safeguards
For workations outside the EEA, Articles 44 to 50 GDPR apply. Employers must demonstrate an adequate level of protection. Standard contractual clauses, binding corporate rules or adequacy decisions of the European Commission are the usual mechanisms.
Technical safeguards as a minimum standard
Mandatory VPN, device encryption, two-factor authentication and regular security updates form the basis. The data protection officer must assess country-specific risks and draw up catalogues of measures.
Mobile device management (MDM) enables remote wiping if a device is lost. This function is particularly relevant during stays abroad, as the risk of theft and the possibility of local third-party access increase.
Remote work policy: structure beats case-by-case decisions
Approval process with defined checkpoints
A structured policy defines clear steps:
- Application at least four weeks before the planned start
- Country approval based on a whitelist / blacklist
- Review of the activity for permanent establishment risk
- Social security and tax review
- Data protection check for third countries
- IT security approval
- Approval by line manager and HR
Country approval based on risk assessment
Whitelist for non-critical countries (EU, EEA, Switzerland) with a simplified approval procedure. Greylist for countries with higher requirements (e.g. adequacy decisions outside the EU). Blacklist for high-risk countries without data protection safeguards or with legal uncertainties.
Maximum durations by country category
EU / EEA / CH: up to 90 days per year, a maximum of 30 consecutive days without a special review.
Countries with an adequacy decision: up to 60 days per year after a case-by-case review.
Third countries without an adequacy decision: restrictive, only for compelling business reasons, a maximum of 30 days after a comprehensive risk review.
Documentation duties for employees
Obligation to record working time without gaps during the stay abroad. Use of company devices and VPN connections. Reporting of security incidents within 24 hours. Confirmation of compliance with IT security guidelines.
Template: core clauses for a workation agreement
Country restriction: permitted countries according to the current whitelist.
Time limit: maximum length of stay per year and per continuous period.
Social security evidence: obligation to present the A1 certificate for stays in the EU.
Working time documentation: daily working time recording in an approved system.
Data protection and IT security: use of VPN, encrypted connections and company devices.
Availability: participation in meetings during German working hours, as far as reasonable given the time difference.
Costs: the employer does not cover travel, accommodation or visa costs.
Insurance cover: confirmation of sufficient health insurance cover in the destination country.
Right of revocation: the employer can revoke the approval in the event of legal changes or compliance risks.
Practical implementation: tools and processes
Time recording as compliance evidence
With working time recording in ZEP, employees book their working hours in compliance with the law. The solution works regardless of location, documents breaks and overtime and generates evidence for the authorities.
Via the interfaces, booked hours can be passed to existing HR systems, for example for evaluations by country of work. This data is the basis for social security and tax reporting.
Project controlling for international teams
International projects require precise assignment of work to cost centres and places of work. Project controlling in ZEP maps cross-border team structures and enables billing according to cause.
The solution records which activities were performed in which countries. This information is relevant for permanent establishment audits and the allocation of profits for tax purposes.
Bringing HR, finance and IT together
Successful remote work policies require collaboration across departments. HR reviews employment law aspects and social security. Finance assesses tax risks and permanent establishment exposure. IT provides secure infrastructure and access controls.
Central documentation of all approvals, certificates and evidence in one system prevents information gaps and makes tax and social security audits easier.
Checklist: employer approval for remote work from abroad
Check before approval:
☐ Country is on the whitelist, or a case-by-case review is required
☐ Maximum duration not exceeded
☐ Activity profile does not carry a high permanent establishment risk
☐ Social security: A1 certificate applied for or not required
☐ Tax: 183-day rule observed, no permanent establishment in the destination country
☐ Data protection: adequate level of protection demonstrated
☐ IT security: VPN, encryption and MDM activated
☐ Working time: time recording system works in the destination country
☐ Insurance cover: health insurance is valid in the destination country
☐ Availability: time difference allows team communication
Ensure during the stay:
☐ Daily time recording is complete
☐ VPN connection is used at all times
☐ Sensitive data is only accessed via secure connections
☐ Security incidents are reported immediately
☐ Changes to the length of stay are communicated in good time
Document after returning:
☐ Working time records archived
☐ Record of activities created for tax purposes
☐ IT security check carried out
☐ Lessons learned recorded to improve the policy
Table: risks and measures at a glance
Decision tree: is remote work from country X possible?
Step 1: determine the country category
- EU / EEA / Switzerland? → Simplified procedure
- Country with an adequacy decision? → Extended review
- Third country without adequacy? → Restrictive review or rejection
Step 2: check the length of stay
- Less than 90 days AND EU / EEA / CH? → Less than 25% of total working time? → Check A1
- Between 90 and 183 days? → Check tax split
- More than 183 days? → As a rule, rejection or a complex structural solution
Step 3: assess the activity profile
- Pure delivery without client contact? → Low permanent establishment risk
- Occasional client interaction? → Medium risk, time limit
- Sales with authority to conclude contracts? → High risk, as a rule rejection
Step 4: data protection review
- EU / EEA? → GDPR applies, check IT security standards
- Adequacy decision? → Additional safeguards for sensitive data
- Third country? → Comprehensive protective measures or restriction of activities
Step 5: final decision
- All checkpoints positive → Approval with documented conditions
- One critical point negative → Rejection or rework
- Several critical points → Rejection in principle
ZEP as a central compliance platform for international remote teams
Booked working hours with location details
In ZEP, employees book the start, breaks and end of their working time and, with their consent, also document the location they worked from. This information is the basis for splitting salary day by day under double taxation agreements and for proving the 25 percent threshold for social security purposes.
Based on these bookings, HR managers can track when employees approach social security or tax thresholds and act in good time before A1 certificates become necessary or tax splitting obligations arise.
Project controlling for permanent establishment audits
Project controlling in ZEP shows which activities were performed in which countries for which clients. This data basis is decisive in permanent establishment audits: tax authorities require traceable documentation of whether remote work abroad actually had commercial reasons or merely fulfilled employees' wishes.
Project time tracking distinguishes between internal activities, client work without a local link and activities directly linked to a country. This distinction enables risk-based approval processes: developers with purely internal project work get approval more easily than sales staff with client contact.
Resource Planning takes time zones and availability into account
Resource Planning visualises team availability across different time zones. Managers see at a glance which team members can be reached when and can coordinate meeting times accordingly.
When approving stays abroad, this makes it possible to check whether there is enough overlap with German working hours. Critical projects with a high need for coordination can thus be excluded from workation requests in incompatible time zones.
Absences & Overtime includes workation approvals
The Absences & Overtime feature in ZEP distinguishes between vacation, sickness, home office and workation. Workation requests go through defined approval processes with checkpoints for country approval, social security and data protection.
The approval history documents who approved which stays abroad, when and on what basis. This evidence is indispensable in audits by tax offices or social security institutions.
DATEV integration for payroll accounting
The DATEV interface transfers the booked working hours directly to payroll accounting. Tax advisers receive structured data for splitting salary day by day under DTA rules, without manually preparing Excel lists.
For employees who regularly work abroad, the booked hours provide the data for evaluations by country of work. This data forms the basis for tax returns and social security reports.
Conclusion: structure makes you able to act
Remote work from abroad requires systematic compliance management across five areas of law. Employers that want to stay competitive in 2026 need documented policies, working processes and reliable tools.
Integrating time recording, project controlling and document management is not a technical luxury but an operational necessity. With working time recording, project controlling and remote work compliance, ZEP provides the infrastructure needed for legally compliant cross-border work.
Legal requirements will continue to become more specific. Companies that establish structures now are prepared for future developments and use flexible working models as a strategic advantage rather than a compliance risk.
FAQs
Which countries can employees work from on a workation for a German employer?
There is no official country whitelist for workations. What matters is the country category: EU/EEA states (the 27 EU countries plus Iceland, Liechtenstein and Norway) and Switzerland allow simplified procedures with an A1 certificate. The multilateral framework agreement on cross-border telework applies to 22 states, including all of Germany's neighbouring countries, Finland, Ireland, Spain and Portugal. Third countries with an EU adequacy decision (e.g. Japan, Canada, UK) require more extensive checks. Countries without an adequacy decision require comprehensive data protection safeguards and should be handled restrictively. Employers draw up internal whitelists based on a risk assessment covering social security, tax, permanent establishment and data protection.
The A1 certificate has been electronic-only since 2025. How exactly does it work?
Since 1 January 2025, paper applications for A1 certificates are no longer accepted in Germany. Employers apply via their certified payroll software or the SV-Meldeportal (social security reporting portal). Registration is done with an ELSTER organisation certificate or BundID. After submitting the application, employers receive an electronic response with a PDF certificate within three working days. Since February 2025, cross-border commuters can also apply themselves via the SV-Meldeportal using BundID. The responsible body is the health insurance fund for statutorily insured employees, the German Pension Insurance (Deutsche Rentenversicherung) for privately insured employees, and the DVKA for people with multiple jobs and exception agreements. The application must be submitted before the work abroad begins; for short business trips of less than seven days, a retrospective application is permitted.
Where do I pay tax if I work abroad for a German employer?
Tax liability follows the place-of-work principle: income is taxed where the work is actually performed. Under the 183-day rule, income is taxed exclusively in Germany only if three conditions are met at the same time: a stay of less than 183 days in the state of activity, salary paid by an employer resident in Germany, and no costs borne by a permanent establishment in the state of activity. If the threshold is exceeded or a condition is not met, salary is split day by day under the applicable double taxation agreement (DTA). The relevant period varies by DTA: calendar year (most common), a different tax year (UK: 6 April to 5 April) or a rolling twelve-month period (Luxembourg, Norway). Employers must document working days per country and, in mixed cases from 2025, must use the daily table for calculating wage tax.
How do I avoid a permanent establishment with a remote work policy?
Avoiding a permanent establishment requires three measures. First, a time limit of less than 50 percent of working time per country over twelve months. Second, excluding commercial-reason activities by classifying roles by risk profile: low-risk activities (pure development, internal project work without local interaction) get approval more easily, while high-risk activities (sales with authority to conclude contracts, managing director functions, strategic decisions with a local link) are excluded as a rule. Third, a documented policy with an approval process: application at least four weeks in advance, review of the activity profile and commercial reason, and written confirmation that no regular on-site client contact takes place. The OECD 2025 update confirms that cost savings or employee retention alone do not create a permanent establishment; what matters is physical access to local markets, customers or resources.
Which time recording is suitable for remote work from abroad?
Time recording systems for international remote work must meet five requirements. First, automatic country assignment of recorded working hours for social security and tax reporting. Second, threshold monitoring with automatic warnings when approaching the 25 percent limit (social security) or the 50 percent limit (permanent establishment). Third, location-independent functionality without mandatory GPS, as location tracking raises data protection concerns. Fourth, interfaces to payroll accounting (DATEV) for automatically transferring working hours with a country code. Fifth, compliance reports at the push of a button: A1 evidence report, 183-day tracking per employee and country, and permanent establishment risk evaluations by place of work. Also relevant: time zone management for team coordination, integration with project controlling for activity-based documentation, and audit-proof archiving for tax audits.
What does the 49.99 percent rule for cross-border telework mean?
The 49.99 percent rule allows cross-border commuters who work a larger share from home in their country of residence to remain covered by German social security law. Basic rule: from 25 percent of working time in the foreign country of residence, social security liability automatically moves there. The multilateral framework agreement of July 2023 creates an exception: employers can apply for an exception agreement under Article 16 of Regulation (EC) No 883/2004 for home office shares between 25 and 49.99 percent. The agreement applies for a maximum of three years and must then be renewed. Prerequisite: continuous social security contributions in Germany during the period. Since 2025, applications have been made exclusively electronically via the DVKA. Important: at 50 percent or more, the exception no longer applies and social security liability must move to the country of residence. The 22 signatory states include all of Germany's neighbouring countries plus Finland, Ireland, Spain, Portugal, Sweden, Malta, Croatia, Lithuania and Slovenia.
