Bureaucracy costs in a European comparison

What is the bureaucratic burden on SMEs imposed by EU law? This question is answered by Prognos and the Centre for European Policy (cep) for the German Foundation for Family Businesses.

For this purpose, we look at four areas of law:

• the A1 certificate for short-term work in EU countries
• the Posting of Workers Directive on services in the European Single Market
• the transparency register
• and parts of the General Data Protection Regulation (GDPR)

Laws and directives: How much effort is required?

To enable assessment of the four areas – A1 certification, the Posting of Workers Directive, the transparency register, and the GDPR – and the bureaucratic effort associated with them, the cep first issues a legal opinion for each of them. This is followed by an assessment conducted by Prognos and its partner, the Centre for Industrial Studies (CSIL) in Milan, on how much time and cost companies incur as a result of the regulations. We have focused on Germany, Austria, Italy, and France.

The extent to which the regulations themselves are effective is not taken into consideration. Rather, we estimate where, in the four areas, bureaucracy can become more efficient or digital. The empirical assessment is based on interviews we conducted with companies and experts in the four countries.

Lessons learnt: Approaches to reducing bureaucracy

What can be learnt from the four case studies for reducing bureaucracy in companies? We have summarised the key findings in six theses:

1. Execution makes the music: Substantial relief can be realised in administrative execution.
2. "Digital" does not equal "digital": User-orientation is the key to efficiency.
3. Complex and complicated: Information procurement costs are a key cost driver.
4. Exceptionally usable: Making exceptions practicable.
5. (Not) a game changer: Gold plating and regulatory requirements.
6. A long way to go: Harmonisation with conflicting objectives.

Results and adjustment proposals

Part 1: A1 certificate

Under EU law, a person is only subject to the social security law of a single Member State, usually the state in which the person is working. However, if the employer decides to transfer this person to another EU country for a maximum of two years, the employee is subject to the law of the country they come from. In this case, upon request, the social security institution of the home country provides proof of the current validity of cover: The A1 certificate.

EU law does not, however, specify which information must be provided on the A1 certificate – the specifications vary from country to country and are sometimes extensive. Even though all four countries examined offer online solutions for applying for A1 certificates, the time required differs significantly: From over 30 minutes in Italy to just under 20 minutes in Austria. The resulting costs also fluctuate accordingly. Fulfillment costs range from seven euros per transaction in Austria (6.80 euros) and France (7.12 euros) to more than ten euros in Italy and Germany (10.28 euros). 

Our research resulted in the following suggestions for reducing the bureaucratic burden:

• the introduction of a European Social Security Card as proof of national membership to a social security system – as a result, A1 certificates would only need to be issued in a few cases
• the merging of the processes for A1 certification and the Posting Directive
• processing via an EU-wide portal: This would give companies a single point of contact for the posting of employees to another EU Member State
• EU countries (especially Germany) should set up online portals to enable user-friendly applications
• simplifying requirements, for example, for short stays (less than five days), in border regions, or for home-office working

Part 2: Posting policy (February 2023)

If a company dispatches employees to another EU member state, not only must it apply for an A1 certificate from the national authorities, but under certain circumstances the dispatch must also be registered in the host country. This is to prevent a posting that would undermine national standards.

Here, EU law gives Member States the opportunity to adopt their own provisions on compliance with the Posting of Workers Directive. In reality the results are correspondingly diverse: in the four countries examined, the requirements to be observed when posting workers vary. Our study shows that, in particular, the information and reporting requirements in France and Austria are above averagely expensive, which points to socalled gold plating – the national tightening of European requirements.

Companies are challenged by the variety of national requirements to be met – from the translation of employment contracts into the respective national language to the submission of medical evidence. Our research shows:

• high time expenditure of 66 to 80 minutes for the registration of a posting, despite the available digital solutions in all Member States
• considerable efforts are required to familiarise yourself with the applicable national provisions
• language barriers are a major cost driver

In order to reduce the burden on companies, we therefore propose:

• the harmonisation of EU-wide requirements, for example, by establishing a common list of exemptions, and reducing and standardising documentation requirements
• English be recognised as a common language for the translation and transmission of documents and information
• the consolidation of the application procedures for A1 certificates and the Posting of Workers Directive as well as the establishment of a single reporting portal for this purpose
• that if an EU-level agreement is not foreseeable we recommend strengthening the respective national portals that provide companies with all the necessary information about the requirements of other EU Member States for the posting of workers
• the exemption of shortterm work from the requirements of the Posting of Workers Directive

Part 3: Transparency register (March 2023)

As one of the measures to combat money laundering, since 2017, EU law has required Member States to set up central transparency registers. These registers contain information about the “beneficial owners” of a company and make the ownership structure transparent. Transparency registers can take the form of an independent public register or be part of an existing commercial register – EU law does not specify this. As Volume 3 of our study, we examined the administrative implementation of this in Germany, Italy, France, and Austria, although, when the study was published, Italy did not yet have an active transparency register in place.

Our study shows that, despite the national registers themselves requiring largely identical information, there are large differences in the administrative burden on companies. The comparison of the time and costs involved to comply with legal requirements clearly shows the advantages of an automatic data synchronisation with existing registers according to the “once-only principle.” For many companies in Austria, for example, the filling out of the transparency register is automated based on the commercial register’s data, while companies in Germany required up to 45 minutes to register.

Therefore our recommendations aim primarily to simplify the implementation of the Transparency Registries, in particular:

• in the long term, the establishment of a European register instead of multiple national registers
• in the short to medium term, the use of the once-only principle for national registers to make the effort of data entry for companies largely superfluous
• improving the functionality (“user experience”) of existing digital solutions
• better advice and accessibility of registry-keeping facilities

Part 4: General Data Protection Regulation (June 2023)

The General Data Protection Regulation (GDPR) aims to improve the protection of personal data and to standardise data protection legislation in Europe. Two articles of the GDPR were analysed as in the fourth part of the study: Article 30 requires companies to record all processing activities relating to personal data in a record of processing activities (RPA). Article 33 obliges companies to inform the competent supervisory authority within 72 hours in the event of a data breach.

In application, this leads to considerable costs for the companies analysed, although the implementation of and compliance with Articles 30 and 33 do not differ significantly between the Member States. Rather, the burden depends on the business model and the size of the company and the associated number of processing activities. This also affects SMEs, as practically all companies process special categories of personal data within the meaning of Article 9 (1) and therefore cannot make use of the exemption for small and medium-sized enterprises (Article 30 (5)). Due to insufficiently defined legal terms, companies are highly dependent on official information and templates as well as advice when complying with Article 30 GDPR, whereby the service of the respective data protection authorities is often insufficient. When reporting data breaches, companies spend most of their time and effort on internal processes and risk assessment. The data protection officer must be informed of the data protection incident, carry out a risk assessment and decide whether a report must be made to the data protection authority.

The authors believe that the main starting points for reducing the administrative burden are:

• a more precise definition of undefined legal terms
• enforcement of the opening clause for small and medium-sized enterprises
• better support from the authorities in the form of templates, advice and compliance support
• a standardised online reporting procedure to the data protection authorities with a focus on user centricity, smooth user experience and automation

Links and downloads

More information on the evaluation of the results can be found on the pages of the Foundation for Family Businesses (in German).

Lessons learnt: Thesis paper on reducing bureaucracy (PDF in German)

Download Volume 1 (PDF in English)

Download Volumen 2 (PDF in Englisch)

Download Volumen 3 (PDF in Englisch)

Volume 4: GDPR (PDF, in English)

Project team: Sarah Anders, Paul Braunsdorf, Pia Czarnetzki, Jan Felix Czichon, Henner Kropp, Lorenz Löffler, Michael Schaaf, Jan Tiessen

Last update: 14.06.2023