Spain's Mandatory Digital Time-Tracking Rule in 2026: What It Means for SMEs and Their Payroll Advisors

Direct answer: since 2026, every Spanish company — regardless of size or sector — must keep a digital, tamper-proof daily record (registro de jornada) of each employee's actual working hours, under the reformed Article 34.9 of the Estatuto de los Trabajadores. Paper sign-in sheets and editable spreadsheets no longer satisfy the legal standard, and the Labour Inspectorate (Inspección de Trabajo y Seguridad Social, ITSS) can now check compliance remotely. For foreign-owned SMEs operating in Spain and the gestorías laborales that manage their payroll, this is not a minor administrative update — it is a shift in what "compliant" looks like, and it changes what clients should expect from their advisor.

If you run a small business in Spain, or you advise one from abroad through a local gestoría, the practical question is rarely "is time-tracking required" — that has been settled since the 2019 reform introduced the obligation in the first place. The live question in 2026 is which systems still count as valid, how much a gap in your records can cost, and how the gestoría relationship needs to change so the firm catches problems before an inspector does.

What the law actually requires: Article 34.9 ET and its 2026 reinforcement

The obligation itself is not new — it has applied to every employer since 2019, full stop, no exemption for micro-businesses or for companies with fewer than ten staff. What changed going into 2026 is enforcement: the reform strengthens the requirement that records be digital and non-manipulable, and it gives the ITSS a remote, systematic way to request exports during an inspection rather than relying only on physical site visits. In practice, that means a company that kept a plausible-looking Excel file for years, and was never checked, faces a materially higher chance of being asked for that file — and of the file failing to hold up.

Why Excel and paper sign-in sheets no longer pass inspection

Spanish case law has been unusually specific about what fails. Tribunal Supremo rulings interpreting Article 34.9 have repeatedly rejected records showing an implausibly uniform pattern — everyone clocking in at 08:00 and out at 17:00, every day, with no variation — treating that pattern itself as evidence the log was filled in after the fact rather than recorded in real time. A spreadsheet anyone in the office can open and edit fails on the same logic: if the system does not prevent retroactive changes, it cannot prove the hours were real.

For a digital system to hold up under an ITSS review, three elements generally need to be present at once: the timestamp must be generated automatically and synced to an official time source, not typed in manually; any correction must be logged as a correction, dated and attributable to whoever made it, rather than silently overwriting the original entry; and the export must be producible on demand, in a format the inspector can read, without requiring days of preparation. A system missing any one of these is treated, for legal purposes, as equivalent to having no record at all.

Penalties: what a compliance gap actually costs

Sanctions fall under the Ley de Infracciones y Sanciones en el Orden Social (LISOS), and the way they are calculated matters as much as the headline figures: since a recent reform, penalties for time-tracking failures are assessed per affected worker, not once for the whole company. A ten-person business with no valid system is not looking at a single fine — it is looking at up to ten.

Beyond the fine itself, an adverse finding typically triggers two further consequences that surprise foreign owners more than the penalty does. First, the company loses any hiring-related Social Security rebates or bonificaciones it was benefiting from, immediately and retroactively in some cases. Second, the ITSS commonly opens a liquidación de cuotas — a back-payment order for the employer's share of Social Security contributions on any undeclared overtime found, going back up to four years. On a mid-sized payroll, that back-payment can dwarf the original administrative fine.

Remote work and field staff: the cases that trip up SMEs most often

Two categories of employee generate a disproportionate share of enforcement action, and both are common in the SMEs that lean on a gestoría for compliance rather than an in-house HR department:

A real transition case: from paper sign-in sheets to a system that survived inspection

A metalworking company with 35 employees split between factory floor staff and travelling technicians used printed monthly sign-in sheets that workers filled in by hand at the end of each shift. During a routine inspection, the officer noticed that roughly 90% of the entries showed identical clock-in times (08:00) and clock-out times (17:00) — the same "implausibly flat pattern" Spanish courts have specifically called out as evidence of retrospective, not real-time, recording. The company was fined €4,500 for a deficient record and for the impossibility of verifying the field technicians' actual overtime.

Following the fine, the company implemented a digital time-tracking system connected to its compliance advisor's platform: field technicians clocked in from their mobile devices with geolocation active only at the moment of punching in, and factory staff switched to a shared tablet with facial recognition. At the next inspection, the company exported the previous three months' full history in under two minutes, free of flat patterns and validated by the employee representatives — avoiding any further sanction.

How gestorías laborales need to adapt their service model

For a gestoría managing payroll for a portfolio of SME clients, this reform changes the job description. Historically, many firms treated time-tracking as the client's own operational concern — something to ask about only if an inspection actually happened. That posture is now a liability: a client that gets fined can reasonably ask why their advisor never flagged the exposure, especially when the gestoría already has visibility into payroll data that would reveal a flat, implausible pattern.

A more defensible service model has four components. First, an active audit of every client's current system — not waiting to be asked, but proactively identifying which clients still rely on paper or spreadsheets. Second, mapping each client's applicable convenio colectivo so that on-call time, travel time and overtime rules are correctly parameterised rather than left to a generic default. Third, being able to answer a client's time-tracking question — "does this remote employee's schedule count as compliant?" — with a citation to the exact legal basis, in minutes, not after a multi-day search through the BOE and case law. Fourth, treating this as a recurring conversation with clients rather than a one-off migration project, since inspection risk does not go away once a digital system is switched on — it shifts to whether the system is configured correctly and kept that way.

This is the kind of workload where a RAG-based compliance assistant changes the economics for a small or mid-sized gestoría. IgeraGestorías is built specifically for payroll and tax advisory firms handling exactly this volume of recurring, citation-dependent questions — cross-referencing a client's actual timekeeping records against the applicable convenio and current LISOS thresholds, and answering with the specific article or clause behind the answer, instead of a generic AI response with no legal basis attached.

In summary: what SMEs and their advisors need to check now

Frequently asked questions

Does the mandatory time-tracking rule apply to a foreign-owned company with just one or two employees in Spain?

Yes. Article 34.9 ET applies to every employer with staff on a Spanish payroll, regardless of company size, sector, or where the parent company is headquartered. There is no headcount threshold below which the obligation stops applying.

Can a company use a time-tracking tool built for another country's labour law?

Only if that tool specifically produces a timestamped, non-editable log that can be exported in a format the ITSS accepts. Many international HR platforms track hours for internal or payroll purposes without meeting the Spanish evidentiary requirements around non-manipulability and real-time accessibility — this is worth confirming with the vendor or your gestoría before relying on it.

How far back can the Labour Inspectorate look when reviewing time records?

Records must be kept accessible for at least four years, and a liquidación de cuotas for undeclared overtime found during an inspection can reach back over that same period, which is why the financial exposure from a records gap is often far larger than the headline LISOS fine.

Do employee representatives have a right to see the time-tracking data?

Yes. The legal representation of workers (RLT) has the right to receive the full workforce's time records on a monthly basis. The digital system must be able to generate clear, accessible reports for representatives while still complying with Spanish and EU data protection rules (RGPD).

What should a gestoría tell a client who insists their current spreadsheet has "always worked fine"?

That the absence of a past inspection is not evidence of compliance — it is evidence the system has not been tested yet. Since 2026 the ITSS has a stronger remote-verification capability, and the fact a spreadsheet was never flagged before does not mean it would survive a records request today.

Can IgeraGestorías help a gestoría manage this across an entire client portfolio?

IgeraGestorías centralises the applicable legal framework — Article 34.9 ET, the LISOS penalty scale, and relevant convenios colectivos — so advisors can answer client-specific time-tracking questions in seconds, with the exact legal basis cited, instead of researching each case from scratch.